]> git.ipfire.org Git - ipfire-2.x.git/blob - src/patches/bash/bash32-052
bash: Import upstream patches for CVE-2014-6271 and CVE-2014-7169
[ipfire-2.x.git] / src / patches / bash / bash32-052
1 BASH PATCH REPORT
2 =================
3
4 Bash-Release: 3.2
5 Patch-ID: bash32-052
6
7 Bug-Reported-by: Stephane Chazelas <stephane.chazelas@gmail.com>
8 Bug-Reference-ID:
9 Bug-Reference-URL:
10
11 Bug-Description:
12
13 Under certain circumstances, bash will execute user code while processing the
14 environment for exported function definitions.
15
16 Patch (apply with `patch -p0'):
17
18 *** ../bash-3.2.51/builtins/common.h 2006-03-06 09:38:44.000000000 -0500
19 --- builtins/common.h 2014-09-16 19:08:02.000000000 -0400
20 ***************
21 *** 34,37 ****
22 --- 34,39 ----
23
24 /* Flags for describe_command, shared between type.def and command.def */
25 + #define SEVAL_FUNCDEF 0x080 /* only allow function definitions */
26 + #define SEVAL_ONECMD 0x100 /* only allow a single command */
27 #define CDESC_ALL 0x001 /* type -a */
28 #define CDESC_SHORTDESC 0x002 /* command -V */
29 *** ../bash-3.2.51/builtins/evalstring.c 2008-11-15 17:47:04.000000000 -0500
30 --- builtins/evalstring.c 2014-09-16 19:08:02.000000000 -0400
31 ***************
32 *** 235,238 ****
33 --- 235,246 ----
34 struct fd_bitmap *bitmap;
35
36 + if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)
37 + {
38 + internal_warning ("%s: ignoring function definition attempt", from_file);
39 + should_jump_to_top_level = 0;
40 + last_result = last_command_exit_value = EX_BADUSAGE;
41 + break;
42 + }
43 +
44 bitmap = new_fd_bitmap (FD_BITMAP_SIZE);
45 begin_unwind_frame ("pe_dispose");
46 ***************
47 *** 292,295 ****
48 --- 300,306 ----
49 dispose_fd_bitmap (bitmap);
50 discard_unwind_frame ("pe_dispose");
51 +
52 + if (flags & SEVAL_ONECMD)
53 + break;
54 }
55 }
56 *** ../bash-3.2.51/variables.c 2008-11-15 17:15:06.000000000 -0500
57 --- variables.c 2014-09-16 19:10:39.000000000 -0400
58 ***************
59 *** 319,328 ****
60 strcpy (temp_string + char_index + 1, string);
61
62 ! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST);
63 !
64 ! /* Ancient backwards compatibility. Old versions of bash exported
65 ! functions like name()=() {...} */
66 ! if (name[char_index - 1] == ')' && name[char_index - 2] == '(')
67 ! name[char_index - 2] = '\0';
68
69 if (temp_var = find_function (name))
70 --- 319,326 ----
71 strcpy (temp_string + char_index + 1, string);
72
73 ! /* Don't import function names that are invalid identifiers from the
74 ! environment. */
75 ! if (legal_identifier (name))
76 ! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
77
78 if (temp_var = find_function (name))
79 ***************
80 *** 333,340 ****
81 else
82 report_error (_("error importing function definition for `%s'"), name);
83 -
84 - /* ( */
85 - if (name[char_index - 1] == ')' && name[char_index - 2] == '\0')
86 - name[char_index - 2] = '('; /* ) */
87 }
88 #if defined (ARRAY_VARS)
89 --- 331,334 ----
90 *** ../bash-3.2/patchlevel.h Thu Apr 13 08:31:04 2006
91 --- patchlevel.h Mon Oct 16 14:22:54 2006
92 ***************
93 *** 26,30 ****
94 looks for to find the patch level (for the sccs version string). */
95
96 ! #define PATCHLEVEL 51
97
98 #endif /* _PATCHLEVEL_H_ */
99 --- 26,30 ----
100 looks for to find the patch level (for the sccs version string). */
101
102 ! #define PATCHLEVEL 52
103
104 #endif /* _PATCHLEVEL_H_ */