diff options
| author | Daniil Baturin <daniil@baturin.org> | 2014-09-25 20:18:40 +0200 |
|---|---|---|
| committer | Daniil Baturin <daniil@baturin.org> | 2014-09-25 20:18:40 +0200 |
| commit | 38f3ad640a2ce50cbf934db240afaab2eda2da27 (patch) | |
| tree | 7ffed568f4f97428792c23bd0fdffe25257b3d0e | |
| parent | c196461c4a8e7376d1ce7a1ae675f73861a751cd (diff) | |
| download | vyatta-bash-38f3ad640a2ce50cbf934db240afaab2eda2da27.tar.gz vyatta-bash-38f3ad640a2ce50cbf934db240afaab2eda2da27.zip | |
CVE-2014-6271: Import patch by Chet Ramey.
| -rw-r--r-- | builtins/common.h | 2 | ||||
| -rw-r--r-- | builtins/evalstring.c | 11 | ||||
| -rw-r--r-- | patchlevel.h | 2 | ||||
| -rw-r--r-- | variables.c | 14 |
4 files changed, 18 insertions, 11 deletions
diff --git a/builtins/common.h b/builtins/common.h index efbb078..39ba687 100644 --- a/builtins/common.h +++ b/builtins/common.h @@ -35,6 +35,8 @@ #define SEVAL_NOLONGJMP 0x040 /* Flags for describe_command, shared between type.def and command.def */ +#define SEVAL_FUNCDEF 0x080 /* only allow function definitions */ +#define SEVAL_ONECMD 0x100 /* only allow a single command */ #define CDESC_ALL 0x001 /* type -a */ #define CDESC_SHORTDESC 0x002 /* command -V */ #define CDESC_REUSABLE 0x004 /* command -v */ diff --git a/builtins/evalstring.c b/builtins/evalstring.c index 40abe00..ab43f23 100644 --- a/builtins/evalstring.c +++ b/builtins/evalstring.c @@ -261,6 +261,14 @@ parse_and_execute (string, from_file, flags) { struct fd_bitmap *bitmap; + if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) + { + internal_warning ("%s: ignoring function definition attempt", from_file); + should_jump_to_top_level = 0; + last_result = last_command_exit_value = EX_BADUSAGE; + break; + } + bitmap = new_fd_bitmap (FD_BITMAP_SIZE); begin_unwind_frame ("pe_dispose"); add_unwind_protect (dispose_fd_bitmap, bitmap); @@ -321,6 +329,9 @@ parse_and_execute (string, from_file, flags) dispose_command (command); dispose_fd_bitmap (bitmap); discard_unwind_frame ("pe_dispose"); + + if (flags & SEVAL_ONECMD) + break; } } else diff --git a/patchlevel.h b/patchlevel.h index 2af2f56..b7bba6a 100644 --- a/patchlevel.h +++ b/patchlevel.h @@ -25,6 +25,6 @@ regexp `^#define[ ]*PATCHLEVEL', since that's what support/mkversion.sh looks for to find the patch level (for the sccs version string). */ -#define PATCHLEVEL 0 +#define PATCHLEVEL 48 #endif /* _PATCHLEVEL_H_ */ diff --git a/variables.c b/variables.c index d1da8f6..e5106e0 100644 --- a/variables.c +++ b/variables.c @@ -347,12 +347,10 @@ initialize_shell_variables (env, privmode) temp_string[char_index] = ' '; strcpy (temp_string + char_index + 1, string); - parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST); - - /* Ancient backwards compatibility. Old versions of bash exported - functions like name()=() {...} */ - if (name[char_index - 1] == ')' && name[char_index - 2] == '(') - name[char_index - 2] = '\0'; + /* Don't import function names that are invalid identifiers from the + environment. */ + if (legal_identifier (name)) + parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD); if (temp_var = find_function (name)) { @@ -361,10 +359,6 @@ initialize_shell_variables (env, privmode) } else report_error (_("error importing function definition for `%s'"), name); - - /* ( */ - if (name[char_index - 1] == ')' && name[char_index - 2] == '\0') - name[char_index - 2] = '('; /* ) */ } #if defined (ARRAY_VARS) # if 0 |