rcolebaugh / rpms / bash

Forked from rpms/bash a year ago
Clone

Blame SOURCES/bash-4.2-cve-2014-7169-2.patch

b0c87f
--- ../bash-4.2-orig/parse.y	2014-09-25 13:07:59.218209276 +0200
b0c87f
+++ parse.y	2014-09-25 15:26:52.813159810 +0200
b0c87f
@@ -264,9 +264,21 @@
b0c87f
 
b0c87f
 /* Variables to manage the task of reading here documents, because we need to
b0c87f
    defer the reading until after a complete command has been collected. */
b0c87f
-static REDIRECT *redir_stack[10];
b0c87f
+static REDIRECT **redir_stack;
b0c87f
 int need_here_doc;
b0c87f
 
b0c87f
+/* Pushes REDIR onto redir_stack, resizing it as needed. */
b0c87f
+static void
b0c87f
+push_redir_stack (REDIRECT *redir)
b0c87f
+{
b0c87f
+  /* Guard against oveflow. */
b0c87f
+  if (need_here_doc + 1 > INT_MAX / sizeof (*redir_stack))
b0c87f
+    abort ();
b0c87f
+  redir_stack = xrealloc (redir_stack,
b0c87f
+			  (need_here_doc + 1) * sizeof (*redir_stack));
b0c87f
+  redir_stack[need_here_doc++] = redir;
b0c87f
+}
b0c87f
+
b0c87f
 /* Where shell input comes from.  History expansion is performed on each
b0c87f
    line when the shell is interactive. */
b0c87f
 static char *shell_input_line = (char *)NULL;
b0c87f
@@ -519,42 +531,42 @@
b0c87f
 			  source.dest = 0;
b0c87f
 			  redir.filename = $2;
b0c87f
 			  $$ = make_redirection (source, r_reading_until, redir, 0);
b0c87f
-			  redir_stack[need_here_doc++] = $$;
b0c87f
+			  push_redir_stack ($$);
b0c87f
 			}
b0c87f
 	|	NUMBER LESS_LESS WORD
b0c87f
 			{
b0c87f
 			  source.dest = $1;
b0c87f
 			  redir.filename = $3;
b0c87f
 			  $$ = make_redirection (source, r_reading_until, redir, 0);
b0c87f
-			  redir_stack[need_here_doc++] = $$;
b0c87f
+			  push_redir_stack ($$);
b0c87f
 			}
b0c87f
 	|	REDIR_WORD LESS_LESS WORD
b0c87f
 			{
b0c87f
 			  source.filename = $1;
b0c87f
 			  redir.filename = $3;
b0c87f
 			  $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
b0c87f
-			  redir_stack[need_here_doc++] = $$;
b0c87f
+			  push_redir_stack ($$);
b0c87f
 			}
b0c87f
 	|	LESS_LESS_MINUS WORD
b0c87f
 			{
b0c87f
 			  source.dest = 0;
b0c87f
 			  redir.filename = $2;
b0c87f
 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
b0c87f
-			  redir_stack[need_here_doc++] = $$;
b0c87f
+			  push_redir_stack ($$);
b0c87f
 			}
b0c87f
 	|	NUMBER LESS_LESS_MINUS WORD
b0c87f
 			{
b0c87f
 			  source.dest = $1;
b0c87f
 			  redir.filename = $3;
b0c87f
 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
b0c87f
-			  redir_stack[need_here_doc++] = $$;
b0c87f
+			  push_redir_stack ($$);
b0c87f
 			}
b0c87f
 	|	REDIR_WORD  LESS_LESS_MINUS WORD
b0c87f
 			{
b0c87f
 			  source.filename = $1;
b0c87f
 			  redir.filename = $3;
b0c87f
 			  $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
b0c87f
-			  redir_stack[need_here_doc++] = $$;
b0c87f
+			  push_redir_stack ($$);
b0c87f
 			}
b0c87f
 	|	LESS_LESS_LESS WORD
b0c87f
 			{
b0c87f
@@ -4757,7 +4769,7 @@
b0c87f
     case CASE:
b0c87f
     case SELECT:
b0c87f
     case FOR:
b0c87f
-      if (word_top < MAX_CASE_NEST)
b0c87f
+      if (word_top + 1 < MAX_CASE_NEST)
b0c87f
 	word_top++;
b0c87f
       word_lineno[word_top] = line_number;
b0c87f
       break;