From 18a9f7975e0e08946b85d88306183a47ec3efb19 Mon Sep 17 00:00:00 2001 From: Ondrej Oprala Date: Oct 06 2014 04:47:03 +0000 Subject: Patchlevel 53 --- diff --git a/bash.spec b/bash.spec index 2ab5a72..2e3827d 100644 --- a/bash.spec +++ b/bash.spec @@ -1,5 +1,5 @@ #% define beta_tag rc2 -%define patchleveltag .51 +%define patchleveltag .53 %define baseversion 4.2 %bcond_without tests @@ -80,6 +80,9 @@ Patch050: bash-4.2-cve-2014-7169-1.patch #patchlevel 51 Patch051: bash-4.2-cve-2014-7169-2.patch +Patch052: ftp://ftp.gnu.org/pub/gnu/bash/bash-4.2-patches/bash42-052 +Patch053: ftp://ftp.gnu.org/pub/gnu/bash/bash-4.2-patches/bash42-053 + # Other patches Patch101: bash-2.02-security.patch @@ -209,6 +212,8 @@ This package contains documentation files for %{name}. %patch049 -p0 -b .049 %patch050 -p0 -b .7169-1 %patch051 -p0 -b .7169-2 +%patch052 -p0 -b .052 +%patch053 -p0 -b .053 # Other patches %patch101 -p1 -b .security @@ -429,6 +434,9 @@ end #%doc doc/*.ps doc/*.0 doc/*.html doc/article.txt %changelog +* Mon Oct 06 2014 Ondrej Oprala - 4.2.53-1 +- Patchlevel 53 + * Mon Oct 06 2014 Ondrej Oprala - 4.2.51-1 - RedHat's patchlevel 51 diff --git a/bash42-052 b/bash42-052 new file mode 100644 index 0000000..43fc6be --- /dev/null +++ b/bash42-052 @@ -0,0 +1,59 @@ + BASH PATCH REPORT + ================= + +Bash-Release: 4.2 +Patch-ID: bash42-052 + +Bug-Reported-by: Michal Zalewski +Bug-Reference-ID: +Bug-Reference-URL: + +Bug-Description: + +When bash is parsing a function definition that contains a here-document +delimited by end-of-file (or end-of-string), it leaves the closing delimiter +uninitialized. This can result in an invalid memory access when the parsed +function is later copied. + +Patch (apply with `patch -p0'): + +*** ../bash-4.2.51/make_cmd.c 2009-09-11 17:26:12.000000000 -0400 +--- make_cmd.c 2014-10-02 11:26:58.000000000 -0400 +*************** +*** 690,693 **** +--- 690,694 ---- + temp->redirector = source; + temp->redirectee = dest_and_filename; ++ temp->here_doc_eof = 0; + temp->instruction = instruction; + temp->flags = 0; +*** ../bash-4.2.51/copy_cmd.c 2009-09-11 16:28:02.000000000 -0400 +--- copy_cmd.c 2014-10-02 11:26:58.000000000 -0400 +*************** +*** 127,131 **** + case r_reading_until: + case r_deblank_reading_until: +! new_redirect->here_doc_eof = savestring (redirect->here_doc_eof); + /*FALLTHROUGH*/ + case r_reading_string: +--- 127,131 ---- + case r_reading_until: + case r_deblank_reading_until: +! new_redirect->here_doc_eof = redirect->here_doc_eof ? savestring (redirect->here_doc_eof) : 0; + /*FALLTHROUGH*/ + case r_reading_string: +*** ../bash-4.2-patched/patchlevel.h Sat Jun 12 20:14:48 2010 +--- patchlevel.h Thu Feb 24 21:41:34 2011 +*************** +*** 26,30 **** + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 49 + + #endif /* _PATCHLEVEL_H_ */ +--- 26,30 ---- + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 52 + + #endif /* _PATCHLEVEL_H_ */ diff --git a/bash42-053 b/bash42-053 new file mode 100644 index 0000000..cffd622 --- /dev/null +++ b/bash42-053 @@ -0,0 +1,132 @@ + BASH PATCH REPORT + ================= + +Bash-Release: 4.2 +Patch-ID: bash42-053 + +Bug-Reported-by: Michal Zalewski +Bug-Reference-ID: +Bug-Reference-URL: + +Bug-Description: + +A combination of nested command substitutions and function importing from +the environment can cause bash to execute code appearing in the environment +variable value following the function definition. + +Patch (apply with `patch -p0'): + +*** ../bash-4.2.52/builtins/evalstring.c 2014-09-16 19:35:45.000000000 -0400 +--- builtins/evalstring.c 2014-10-04 15:00:26.000000000 -0400 +*************** +*** 262,271 **** + struct fd_bitmap *bitmap; + +! if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) + { +! internal_warning ("%s: ignoring function definition attempt", from_file); +! should_jump_to_top_level = 0; +! last_result = last_command_exit_value = EX_BADUSAGE; +! break; + } + +--- 262,284 ---- + struct fd_bitmap *bitmap; + +! if (flags & SEVAL_FUNCDEF) + { +! char *x; +! +! /* If the command parses to something other than a straight +! function definition, or if we have not consumed the entire +! string, or if the parser has transformed the function +! name (as parsing will if it begins or ends with shell +! whitespace, for example), reject the attempt */ +! if (command->type != cm_function_def || +! ((x = parser_remaining_input ()) && *x) || +! (STREQ (from_file, command->value.Function_def->name->word) == 0)) +! { +! internal_warning (_("%s: ignoring function definition attempt"), from_file); +! should_jump_to_top_level = 0; +! last_result = last_command_exit_value = EX_BADUSAGE; +! reset_parser (); +! break; +! } + } + +*************** +*** 332,336 **** + + if (flags & SEVAL_ONECMD) +! break; + } + } +--- 345,352 ---- + + if (flags & SEVAL_ONECMD) +! { +! reset_parser (); +! break; +! } + } + } +*** ../bash-4.2.52/parse.y 2014-09-30 19:24:19.000000000 -0400 +--- parse.y 2014-10-04 15:00:26.000000000 -0400 +*************** +*** 2436,2439 **** +--- 2436,2449 ---- + } + ++ char * ++ parser_remaining_input () ++ { ++ if (shell_input_line == 0) ++ return 0; ++ if (shell_input_line_index < 0 || shell_input_line_index >= shell_input_line_len) ++ return '\0'; /* XXX */ ++ return (shell_input_line + shell_input_line_index); ++ } ++ + #ifdef INCLUDE_UNUSED + /* Back the input pointer up by one, effectively `ungetting' a character. */ +*************** +*** 3891,3896 **** + /* reset_parser clears shell_input_line and associated variables */ + restore_input_line_state (&ls); +! if (interactive) +! token_to_read = 0; + + /* Need to find how many characters parse_and_execute consumed, update +--- 3901,3906 ---- + /* reset_parser clears shell_input_line and associated variables */ + restore_input_line_state (&ls); +! +! token_to_read = 0; + + /* Need to find how many characters parse_and_execute consumed, update +*** ../bash-4.2.52/shell.h 2011-11-21 18:03:32.000000000 -0500 +--- shell.h 2014-10-04 15:00:26.000000000 -0400 +*************** +*** 178,181 **** +--- 178,183 ---- + + /* Let's try declaring these here. */ ++ extern char *parser_remaining_input __P((void)); ++ + extern sh_parser_state_t *save_parser_state __P((sh_parser_state_t *)); + extern void restore_parser_state __P((sh_parser_state_t *)); +*** ../bash-4.2-patched/patchlevel.h Sat Jun 12 20:14:48 2010 +--- patchlevel.h Thu Feb 24 21:41:34 2011 +*************** +*** 26,30 **** + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 52 + + #endif /* _PATCHLEVEL_H_ */ +--- 26,30 ---- + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 53 + + #endif /* _PATCHLEVEL_H_ */