Bladeren bron

bash: Update to 4.3.26

 * Fixes CVE-2014-7169.
 * Fix two out-of-bounds array accesses in the bash parser
 * Add prefix & suffix to variables containing exported functions

Ref: http://seclists.org/oss-sec/2014/q3/712

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Jo-Philipp Wich 10 jaren geleden
bovenliggende
commit
f195dcf02c

+ 1
- 1
utils/bash/Makefile Bestand weergeven

@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
10 10
 BASE_VERSION:=4.3
11 11
 
12 12
 PKG_NAME:=bash
13
-PKG_VERSION:=$(BASE_VERSION).25
13
+PKG_VERSION:=$(BASE_VERSION).26
14 14
 PKG_RELEASE:=1
15 15
 
16 16
 PKG_SOURCE:=$(PKG_NAME)-$(BASE_VERSION).tar.gz

+ 54
- 0
utils/bash/patches/126-upstream-bash43-026.patch Bestand weergeven

@@ -0,0 +1,54 @@
1
+			     BASH PATCH REPORT
2
+			     =================
3
+
4
+Bash-Release:	4.3
5
+Patch-ID:	bash43-026
6
+
7
+Bug-Reported-by:	Tavis Ormandy <taviso () cmpxchg8b com>
8
+Bug-Reference-ID:
9
+Bug-Reference-URL:	http://twitter.com/taviso/statuses/514887394294652929
10
+
11
+Bug-Description:
12
+
13
+Under certain circumstances, bash can incorrectly save a lookahead character and
14
+return it on a subsequent call, even when reading a new line.
15
+
16
+Patch (apply with `patch -p0'):
17
+
18
+--- a/parse.y
19
++++ b/parse.y
20
+@@ -2953,6 +2953,8 @@ reset_parser ()
21
+   FREE (word_desc_to_read);
22
+   word_desc_to_read = (WORD_DESC *)NULL;
23
+ 
24
++  eol_ungetc_lookahead = 0;
25
++
26
+   current_token = '\n';		/* XXX */
27
+   last_read_token = '\n';
28
+   token_to_read = '\n';
29
+--- a/y.tab.c
30
++++ b/y.tab.c
31
+@@ -5265,6 +5265,8 @@ reset_parser ()
32
+   FREE (word_desc_to_read);
33
+   word_desc_to_read = (WORD_DESC *)NULL;
34
+ 
35
++  eol_ungetc_lookahead = 0;
36
++
37
+   current_token = '\n';		/* XXX */
38
+   last_read_token = '\n';
39
+   token_to_read = '\n';
40
+@@ -8539,4 +8541,3 @@ set_line_mbstate ()
41
+     }
42
+ }
43
+ #endif /* HANDLE_MULTIBYTE */
44
+-
45
+--- a/patchlevel.h
46
++++ b/patchlevel.h
47
+@@ -25,6 +25,6 @@
48
+    regexp `^#define[ 	]*PATCHLEVEL', since that's what support/mkversion.sh
49
+    looks for to find the patch level (for the sccs version string). */
50
+ 
51
+-#define PATCHLEVEL 25
52
++#define PATCHLEVEL 26
53
+ 
54
+ #endif /* _PATCHLEVEL_H_ */

+ 83
- 0
utils/bash/patches/200-redhat-parser-oob.patch Bestand weergeven

@@ -0,0 +1,83 @@
1
+--- a/parse.y
2
++++ b/parse.y
3
+@@ -265,9 +265,21 @@ int parser_state;
4
+ 
5
+ /* Variables to manage the task of reading here documents, because we need to
6
+    defer the reading until after a complete command has been collected. */
7
+-static REDIRECT *redir_stack[10];
8
++static REDIRECT **redir_stack;
9
+ int need_here_doc;
10
+ 
11
++/* Pushes REDIR onto redir_stack, resizing it as needed. */
12
++static void
13
++push_redir_stack (REDIRECT *redir)
14
++{
15
++  /* Guard against oveflow. */
16
++  if (need_here_doc + 1 > INT_MAX / sizeof (*redir_stack))
17
++    abort ();
18
++  redir_stack = xrealloc (redir_stack,
19
++			  (need_here_doc + 1) * sizeof (*redir_stack));
20
++  redir_stack[need_here_doc++] = redir;
21
++}
22
++
23
+ /* Where shell input comes from.  History expansion is performed on each
24
+    line when the shell is interactive. */
25
+ static char *shell_input_line = (char *)NULL;
26
+@@ -520,42 +532,42 @@ redirection:	'>' WORD
27
+ 			  source.dest = 0;
28
+ 			  redir.filename = $2;
29
+ 			  $$ = make_redirection (source, r_reading_until, redir, 0);
30
+-			  redir_stack[need_here_doc++] = $$;
31
++			  push_redir_stack ($$);
32
+ 			}
33
+ 	|	NUMBER LESS_LESS WORD
34
+ 			{
35
+ 			  source.dest = $1;
36
+ 			  redir.filename = $3;
37
+ 			  $$ = make_redirection (source, r_reading_until, redir, 0);
38
+-			  redir_stack[need_here_doc++] = $$;
39
++			  push_redir_stack ($$);
40
+ 			}
41
+ 	|	REDIR_WORD LESS_LESS WORD
42
+ 			{
43
+ 			  source.filename = $1;
44
+ 			  redir.filename = $3;
45
+ 			  $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
46
+-			  redir_stack[need_here_doc++] = $$;
47
++			  push_redir_stack ($$);
48
+ 			}
49
+ 	|	LESS_LESS_MINUS WORD
50
+ 			{
51
+ 			  source.dest = 0;
52
+ 			  redir.filename = $2;
53
+ 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
54
+-			  redir_stack[need_here_doc++] = $$;
55
++			  push_redir_stack ($$);
56
+ 			}
57
+ 	|	NUMBER LESS_LESS_MINUS WORD
58
+ 			{
59
+ 			  source.dest = $1;
60
+ 			  redir.filename = $3;
61
+ 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
62
+-			  redir_stack[need_here_doc++] = $$;
63
++			  push_redir_stack ($$);
64
+ 			}
65
+ 	|	REDIR_WORD  LESS_LESS_MINUS WORD
66
+ 			{
67
+ 			  source.filename = $1;
68
+ 			  redir.filename = $3;
69
+ 			  $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
70
+-			  redir_stack[need_here_doc++] = $$;
71
++			  push_redir_stack ($$);
72
+ 			}
73
+ 	|	LESS_LESS_LESS WORD
74
+ 			{
75
+@@ -4905,7 +4917,7 @@ got_token:
76
+     case CASE:
77
+     case SELECT:
78
+     case FOR:
79
+-      if (word_top < MAX_CASE_NEST)
80
++      if (word_top + 1 < MAX_CASE_NEST)
81
+ 	word_top++;
82
+       word_lineno[word_top] = line_number;
83
+       break;

+ 148
- 0
utils/bash/patches/201-redhat-variable-affix.patch Bestand weergeven

@@ -0,0 +1,148 @@
1
+--- a/variables.c
2
++++ b/variables.c
3
+@@ -279,7 +279,7 @@ static void push_temp_var __P((PTR_T));
4
+ static void propagate_temp_var __P((PTR_T));
5
+ static void dispose_temporary_env __P((sh_free_func_t *));     
6
+ 
7
+-static inline char *mk_env_string __P((const char *, const char *));
8
++static inline char *mk_env_string __P((const char *, const char *, int));
9
+ static char **make_env_array_from_var_list __P((SHELL_VAR **));
10
+ static char **make_var_export_array __P((VAR_CONTEXT *));
11
+ static char **make_func_export_array __P((void));
12
+@@ -312,6 +312,14 @@ create_variable_tables ()
13
+ #endif
14
+ }
15
+ 
16
++/* Prefix and suffix for environment variable names which contain
17
++   shell functions. */
18
++#define FUNCDEF_PREFIX "BASH_FUNC_"
19
++#define FUNCDEF_PREFIX_LEN (strlen (FUNCDEF_PREFIX))
20
++#define FUNCDEF_SUFFIX "()"
21
++#define FUNCDEF_SUFFIX_LEN (strlen (FUNCDEF_SUFFIX))
22
++
23
++
24
+ /* Initialize the shell variables from the current environment.
25
+    If PRIVMODE is nonzero, don't import functions from ENV or
26
+    parse $SHELLOPTS. */
27
+@@ -349,22 +357,31 @@ initialize_shell_variables (env, privmod
28
+ 
29
+       /* If exported function, define it now.  Don't import functions from
30
+ 	 the environment in privileged mode. */
31
+-      if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4))
32
+-	{
33
+-	  string_length = strlen (string);
34
+-	  temp_string = (char *)xmalloc (3 + string_length + char_index);
35
++      if (privmode == 0 && read_but_dont_execute == 0
36
++	  && STREQN (FUNCDEF_PREFIX, name, FUNCDEF_PREFIX_LEN)
37
++	  && STREQ (name + char_index - FUNCDEF_SUFFIX_LEN, FUNCDEF_SUFFIX)
38
++	  && STREQN ("() {", string, 4))
39
++	{
40
++	  size_t name_length
41
++	    = char_index - (FUNCDEF_PREFIX_LEN + FUNCDEF_SUFFIX_LEN);
42
++	  char *temp_name = name + FUNCDEF_PREFIX_LEN;
43
++	  /* Temporarily remove the suffix. */
44
++	  temp_name[name_length] = '\0';
45
+ 
46
+-	  strcpy (temp_string, name);
47
+-	  temp_string[char_index] = ' ';
48
+-	  strcpy (temp_string + char_index + 1, string);
49
++	  string_length = strlen (string);
50
++	  temp_string = (char *)xmalloc (name_length + 1 + string_length + 1);
51
++	  memcpy (temp_string, temp_name, name_length);
52
++	  temp_string[name_length] = ' ';
53
++	  memcpy (temp_string + name_length + 1, string, string_length + 1);
54
+ 
55
+ 	  /* Don't import function names that are invalid identifiers from the
56
+ 	     environment, though we still allow them to be defined as shell
57
+ 	     variables. */
58
+-	  if (legal_identifier (name))
59
+-	    parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
60
++	  if (legal_identifier (temp_name))
61
++	    parse_and_execute (temp_string, temp_name,
62
++			       SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
63
+ 
64
+-	  if (temp_var = find_function (name))
65
++	  if (temp_var = find_function (temp_name))
66
+ 	    {
67
+ 	      VSETATTR (temp_var, (att_exported|att_imported));
68
+ 	      array_needs_making = 1;
69
+@@ -379,6 +396,9 @@ initialize_shell_variables (env, privmod
70
+ 	      last_command_exit_value = 1;
71
+ 	      report_error (_("error importing function definition for `%s'"), name);
72
+ 	    }
73
++
74
++	  /* Restore the original suffix. */
75
++	  temp_name[name_length] = FUNCDEF_SUFFIX[0];
76
+ 	}
77
+ #if defined (ARRAY_VARS)
78
+ #  if ARRAY_EXPORT
79
+@@ -2954,7 +2974,7 @@ assign_in_env (word, flags)
80
+   var->context = variable_context;	/* XXX */
81
+ 
82
+   INVALIDATE_EXPORTSTR (var);
83
+-  var->exportstr = mk_env_string (name, value);
84
++  var->exportstr = mk_env_string (name, value, 0);
85
+ 
86
+   array_needs_making = 1;
87
+ 
88
+@@ -3851,22 +3871,43 @@ merge_temporary_env ()
89
+ /*								    */
90
+ /* **************************************************************** */
91
+ 
92
++/* Returns the string NAME=VALUE if !FUNCTIONP or if VALUE == NULL (in
93
++   which case it is treated as empty).  Otherwise, decorate NAME with
94
++   FUNCDEF_PREFIX and FUNCDEF_SUFFIX, and return a string of the form
95
++   FUNCDEF_PREFIX NAME FUNCDEF_SUFFIX = VALUE (without spaces).  */
96
+ static inline char *
97
+-mk_env_string (name, value)
98
++mk_env_string (name, value, functionp)
99
+      const char *name, *value;
100
++     int functionp;
101
+ {
102
+-  int name_len, value_len;
103
+-  char	*p;
104
++  size_t name_len, value_len;
105
++  char *p, *q;
106
+ 
107
+   name_len = strlen (name);
108
+   value_len = STRLEN (value);
109
+-  p = (char *)xmalloc (2 + name_len + value_len);
110
+-  strcpy (p, name);
111
+-  p[name_len] = '=';
112
++  if (functionp && value != NULL)
113
++    {
114
++      p = (char *)xmalloc (FUNCDEF_PREFIX_LEN + name_len + FUNCDEF_SUFFIX_LEN
115
++			   + 1 + value_len + 1);
116
++      q = p;
117
++      memcpy (q, FUNCDEF_PREFIX, FUNCDEF_PREFIX_LEN);
118
++      q += FUNCDEF_PREFIX_LEN;
119
++      memcpy (q, name, name_len);
120
++      q += name_len;
121
++      memcpy (q, FUNCDEF_SUFFIX, FUNCDEF_SUFFIX_LEN);
122
++      q += FUNCDEF_SUFFIX_LEN;
123
++    }
124
++  else
125
++    {
126
++      p = (char *)xmalloc (name_len + 1 + value_len + 1);
127
++      memcpy (p, name, name_len);
128
++      q = p + name_len;
129
++    }
130
++  q[0] = '=';
131
+   if (value && *value)
132
+-    strcpy (p + name_len + 1, value);
133
++    memcpy (q + 1, value, value_len + 1);
134
+   else
135
+-    p[name_len + 1] = '\0';
136
++    q[1] = '\0';
137
+   return (p);
138
+ }
139
+ 
140
+@@ -3952,7 +3993,7 @@ make_env_array_from_var_list (vars)
141
+ 	  /* Gee, I'd like to get away with not using savestring() if we're
142
+ 	     using the cached exportstr... */
143
+ 	  list[list_index] = USE_EXPORTSTR ? savestring (value)
144
+-					   : mk_env_string (var->name, value);
145
++	    : mk_env_string (var->name, value, function_p (var));
146
+ 
147
+ 	  if (USE_EXPORTSTR == 0)
148
+ 	    SAVE_EXPORTSTR (var, list[list_index]);