Blame SOURCES/bash-4.2-cve-2014-7169-1.patch

b0c87f
--- ../bash-4.2-orig/variables.c	2014-09-25 13:07:59.313209541 +0200
b0c87f
+++ variables.c	2014-09-25 13:15:29.869420719 +0200
b0c87f
@@ -268,7 +268,7 @@
b0c87f
 static void propagate_temp_var __P((PTR_T));
b0c87f
 static void dispose_temporary_env __P((sh_free_func_t *));     
b0c87f
 
b0c87f
-static inline char *mk_env_string __P((const char *, const char *));
b0c87f
+static inline char *mk_env_string __P((const char *, const char *, int));
b0c87f
 static char **make_env_array_from_var_list __P((SHELL_VAR **));
b0c87f
 static char **make_var_export_array __P((VAR_CONTEXT *));
b0c87f
 static char **make_func_export_array __P((void));
b0c87f
@@ -301,6 +301,14 @@
b0c87f
 #endif
b0c87f
 }
b0c87f
 
b0c87f
+/* Prefix and suffix for environment variable names which contain
b0c87f
+   shell functions. */
b0c87f
+#define FUNCDEF_PREFIX "BASH_FUNC_"
b0c87f
+#define FUNCDEF_PREFIX_LEN (strlen (FUNCDEF_PREFIX))
b0c87f
+#define FUNCDEF_SUFFIX "()"
b0c87f
+#define FUNCDEF_SUFFIX_LEN (strlen (FUNCDEF_SUFFIX))
b0c87f
+
b0c87f
+
b0c87f
 /* Initialize the shell variables from the current environment.
b0c87f
    If PRIVMODE is nonzero, don't import functions from ENV or
b0c87f
    parse $SHELLOPTS. */
b0c87f
@@ -338,28 +346,40 @@
b0c87f
 
b0c87f
       /* If exported function, define it now.  Don't import functions from
b0c87f
 	 the environment in privileged mode. */
b0c87f
-      if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4))
b0c87f
-	{
b0c87f
-	  string_length = strlen (string);
b0c87f
-	  temp_string = (char *)xmalloc (3 + string_length + char_index);
b0c87f
+      if (privmode == 0 && read_but_dont_execute == 0
b0c87f
+	  && STREQN (FUNCDEF_PREFIX, name, FUNCDEF_PREFIX_LEN)
b0c87f
+	  && STREQ (name + char_index - FUNCDEF_SUFFIX_LEN, FUNCDEF_SUFFIX)
b0c87f
+	  && STREQN ("() {", string, 4))
b0c87f
+	{
b0c87f
+	  size_t name_length
b0c87f
+	    = char_index - (FUNCDEF_PREFIX_LEN + FUNCDEF_SUFFIX_LEN);
b0c87f
+	  char *temp_name = name + FUNCDEF_PREFIX_LEN;
b0c87f
+	  /* Temporarily remove the suffix. */
b0c87f
+	  temp_name[name_length] = '\0';
b0c87f
 
b0c87f
-	  strcpy (temp_string, name);
b0c87f
-	  temp_string[char_index] = ' ';
b0c87f
-	  strcpy (temp_string + char_index + 1, string);
b0c87f
+	  string_length = strlen (string);
b0c87f
+	  temp_string = (char *)xmalloc (name_length + 1 + string_length + 1);
b0c87f
+	  memcpy (temp_string, temp_name, name_length);
b0c87f
+	  temp_string[name_length] = ' ';
b0c87f
+	  memcpy (temp_string + name_length + 1, string, string_length + 1);
b0c87f
 
b0c87f
 	  /* Don't import function names that are invalid identifiers from the
b0c87f
 	     environment, though we still allow them to be defined as shell
b0c87f
	     variables. */
b0c87f
-	  if (legal_identifier (name))
b0c87f
-	    parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
b0c87f
+	  if (legal_identifier (temp_name))
b0c87f
+	    parse_and_execute (temp_string, temp_name,
b0c87f
+			       SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
b0c87f
 
b0c87f
-	  if (temp_var = find_function (name))
b0c87f
+	  if (temp_var = find_function (temp_name))
b0c87f
 	    {
b0c87f
 	      VSETATTR (temp_var, (att_exported|att_imported));
b0c87f
 	      array_needs_making = 1;
b0c87f
 	    }
b0c87f
 	  else
b0c87f
 	    report_error (_("error importing function definition for `%s'"), name);
b0c87f
+
b0c87f
+	  /* Restore the original suffix. */
b0c87f
+	  temp_name[name_length] = FUNCDEF_SUFFIX[0];
b0c87f
 	}
b0c87f
 #if defined (ARRAY_VARS)
b0c87f
 #  if 0
b0c87f
@@ -2537,7 +2557,7 @@
b0c87f
   var->context = variable_context;	/* XXX */
b0c87f
 
b0c87f
   INVALIDATE_EXPORTSTR (var);
b0c87f
-  var->exportstr = mk_env_string (name, value);
b0c87f
+  var->exportstr = mk_env_string (name, value, 0);
b0c87f
 
b0c87f
   array_needs_making = 1;
b0c87f
 
b0c87f
@@ -3388,22 +3408,43 @@
b0c87f
 /*								    */
b0c87f
 /* **************************************************************** */
b0c87f
 
b0c87f
+/* Returns the string NAME=VALUE if !FUNCTIONP or if VALUE == NULL (in
b0c87f
+   which case it is treated as empty).  Otherwise, decorate NAME with
b0c87f
+   FUNCDEF_PREFIX and FUNCDEF_SUFFIX, and return a string of the form
b0c87f
+   FUNCDEF_PREFIX NAME FUNCDEF_SUFFIX = VALUE (without spaces).  */
b0c87f
 static inline char *
b0c87f
-mk_env_string (name, value)
b0c87f
+mk_env_string (name, value, functionp)
b0c87f
      const char *name, *value;
b0c87f
+     int functionp;
b0c87f
 {
b0c87f
-  int name_len, value_len;
b0c87f
-  char	*p;
b0c87f
+  size_t name_len, value_len;
b0c87f
+  char *p, *q;
b0c87f
 
b0c87f
   name_len = strlen (name);
b0c87f
   value_len = STRLEN (value);
b0c87f
-  p = (char *)xmalloc (2 + name_len + value_len);
b0c87f
-  strcpy (p, name);
b0c87f
-  p[name_len] = '=';
b0c87f
+  if (functionp && value != NULL)
b0c87f
+    {
b0c87f
+      p = (char *)xmalloc (FUNCDEF_PREFIX_LEN + name_len + FUNCDEF_SUFFIX_LEN
b0c87f
+			   + 1 + value_len + 1);
b0c87f
+      q = p;
b0c87f
+      memcpy (q, FUNCDEF_PREFIX, FUNCDEF_PREFIX_LEN);
b0c87f
+      q += FUNCDEF_PREFIX_LEN;
b0c87f
+      memcpy (q, name, name_len);
b0c87f
+      q += name_len;
b0c87f
+      memcpy (q, FUNCDEF_SUFFIX, FUNCDEF_SUFFIX_LEN);
b0c87f
+      q += FUNCDEF_SUFFIX_LEN;
b0c87f
+    }
b0c87f
+  else
b0c87f
+    {
b0c87f
+      p = (char *)xmalloc (name_len + 1 + value_len + 1);
b0c87f
+      memcpy (p, name, name_len);
b0c87f
+      q = p + name_len;
b0c87f
+    }
b0c87f
+  q[0] = '=';
b0c87f
   if (value && *value)
b0c87f
-    strcpy (p + name_len + 1, value);
b0c87f
+    memcpy (q + 1, value, value_len + 1);
b0c87f
   else
b0c87f
-    p[name_len + 1] = '\0';
b0c87f
+    q[1] = '\0';
b0c87f
   return (p);
b0c87f
 }
b0c87f
 
b0c87f
@@ -3489,7 +3530,7 @@
b0c87f
 	  /* Gee, I'd like to get away with not using savestring() if we're
b0c87f
 	     using the cached exportstr... */
b0c87f
 	  list[list_index] = USE_EXPORTSTR ? savestring (value)
b0c87f
-					   : mk_env_string (var->name, value);
b0c87f
+	    : mk_env_string (var->name, value, function_p (var));
b0c87f
 
b0c87f
 	  if (USE_EXPORTSTR == 0)
b0c87f
 	    SAVE_EXPORTSTR (var, list[list_index]);