diff options
Diffstat (limited to 'meta/recipes-extended/bash/bash-4.2/cve-2014-6278.patch')
-rw-r--r-- | meta/recipes-extended/bash/bash-4.2/cve-2014-6278.patch | 127 |
1 files changed, 127 insertions, 0 deletions
diff --git a/meta/recipes-extended/bash/bash-4.2/cve-2014-6278.patch b/meta/recipes-extended/bash/bash-4.2/cve-2014-6278.patch new file mode 100644 index 0000000000..b25314fcd7 --- /dev/null +++ b/meta/recipes-extended/bash/bash-4.2/cve-2014-6278.patch | |||
@@ -0,0 +1,127 @@ | |||
1 | bash: Fix CVE-2014-6278 (shellshock) | ||
2 | |||
3 | Upstream-status: backport | ||
4 | |||
5 | Downloaded from: | ||
6 | http://ftp.gnu.org/gnu/bash/bash-4.2-patches/bash42-053 | ||
7 | |||
8 | Author: Chet Ramey <chet.ramey@case.edu> | ||
9 | Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> | ||
10 | |||
11 | BASH PATCH REPORT | ||
12 | ================= | ||
13 | |||
14 | Bash-Release: 4.2 | ||
15 | Patch-ID: bash42-053 | ||
16 | |||
17 | Bug-Reported-by: Michal Zalewski <lcamtuf@coredump.cx> | ||
18 | Bug-Reference-ID: | ||
19 | Bug-Reference-URL: | ||
20 | |||
21 | Bug-Description: | ||
22 | |||
23 | A combination of nested command substitutions and function importing from | ||
24 | the environment can cause bash to execute code appearing in the environment | ||
25 | variable value following the function definition. | ||
26 | |||
27 | Patch (apply with `patch -p0'): | ||
28 | |||
29 | *** ../bash-4.2.52/builtins/evalstring.c 2014-09-16 19:35:45.000000000 -0400 | ||
30 | --- builtins/evalstring.c 2014-10-04 15:00:26.000000000 -0400 | ||
31 | *************** | ||
32 | *** 262,271 **** | ||
33 | struct fd_bitmap *bitmap; | ||
34 | |||
35 | ! if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) | ||
36 | { | ||
37 | ! internal_warning ("%s: ignoring function definition attempt", from_file); | ||
38 | ! should_jump_to_top_level = 0; | ||
39 | ! last_result = last_command_exit_value = EX_BADUSAGE; | ||
40 | ! break; | ||
41 | } | ||
42 | |||
43 | --- 262,284 ---- | ||
44 | struct fd_bitmap *bitmap; | ||
45 | |||
46 | ! if (flags & SEVAL_FUNCDEF) | ||
47 | { | ||
48 | ! char *x; | ||
49 | ! | ||
50 | ! /* If the command parses to something other than a straight | ||
51 | ! function definition, or if we have not consumed the entire | ||
52 | ! string, or if the parser has transformed the function | ||
53 | ! name (as parsing will if it begins or ends with shell | ||
54 | ! whitespace, for example), reject the attempt */ | ||
55 | ! if (command->type != cm_function_def || | ||
56 | ! ((x = parser_remaining_input ()) && *x) || | ||
57 | ! (STREQ (from_file, command->value.Function_def->name->word) == 0)) | ||
58 | ! { | ||
59 | ! internal_warning (_("%s: ignoring function definition attempt"), from_file); | ||
60 | ! should_jump_to_top_level = 0; | ||
61 | ! last_result = last_command_exit_value = EX_BADUSAGE; | ||
62 | ! reset_parser (); | ||
63 | ! break; | ||
64 | ! } | ||
65 | } | ||
66 | |||
67 | *************** | ||
68 | *** 332,336 **** | ||
69 | |||
70 | if (flags & SEVAL_ONECMD) | ||
71 | ! break; | ||
72 | } | ||
73 | } | ||
74 | --- 345,352 ---- | ||
75 | |||
76 | if (flags & SEVAL_ONECMD) | ||
77 | ! { | ||
78 | ! reset_parser (); | ||
79 | ! break; | ||
80 | ! } | ||
81 | } | ||
82 | } | ||
83 | *** ../bash-4.2.52/parse.y 2014-09-30 19:24:19.000000000 -0400 | ||
84 | --- parse.y 2014-10-04 15:00:26.000000000 -0400 | ||
85 | *************** | ||
86 | *** 2436,2439 **** | ||
87 | --- 2436,2449 ---- | ||
88 | } | ||
89 | |||
90 | + char * | ||
91 | + parser_remaining_input () | ||
92 | + { | ||
93 | + if (shell_input_line == 0) | ||
94 | + return 0; | ||
95 | + if (shell_input_line_index < 0 || shell_input_line_index >= shell_input_line_len) | ||
96 | + return '\0'; /* XXX */ | ||
97 | + return (shell_input_line + shell_input_line_index); | ||
98 | + } | ||
99 | + | ||
100 | #ifdef INCLUDE_UNUSED | ||
101 | /* Back the input pointer up by one, effectively `ungetting' a character. */ | ||
102 | *************** | ||
103 | *** 3891,3896 **** | ||
104 | /* reset_parser clears shell_input_line and associated variables */ | ||
105 | restore_input_line_state (&ls); | ||
106 | ! if (interactive) | ||
107 | ! token_to_read = 0; | ||
108 | |||
109 | /* Need to find how many characters parse_and_execute consumed, update | ||
110 | --- 3901,3906 ---- | ||
111 | /* reset_parser clears shell_input_line and associated variables */ | ||
112 | restore_input_line_state (&ls); | ||
113 | ! | ||
114 | ! token_to_read = 0; | ||
115 | |||
116 | /* Need to find how many characters parse_and_execute consumed, update | ||
117 | *** ../bash-4.2.52/shell.h 2011-11-21 18:03:32.000000000 -0500 | ||
118 | --- shell.h 2014-10-04 15:00:26.000000000 -0400 | ||
119 | *************** | ||
120 | *** 178,181 **** | ||
121 | --- 178,183 ---- | ||
122 | |||
123 | /* Let's try declaring these here. */ | ||
124 | + extern char *parser_remaining_input __P((void)); | ||
125 | + | ||
126 | extern sh_parser_state_t *save_parser_state __P((sh_parser_state_t *)); | ||
127 | extern void restore_parser_state __P((sh_parser_state_t *)); | ||