|
|
f686d7 |
From 73eade866e0f1685749c0ec50f49fed0cca0c503 Mon Sep 17 00:00:00 2001
|
|
|
f686d7 |
From: "Barton E. Schaefer" <schaefer@zsh.org>
|
|
|
f686d7 |
Date: Fri, 25 Dec 2015 00:31:32 -0800
|
|
|
f686d7 |
Subject: [PATCH 1/2] 37435 (+ fix typo): allow execution of empty files as
|
|
|
f686d7 |
"sh" scripts
|
|
|
f686d7 |
|
|
|
f686d7 |
Upstream-commit: fc344465f27cdf89664a64fb157b7606c9eb837f
|
|
|
f686d7 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
f686d7 |
---
|
|
|
f686d7 |
Src/exec.c | 3 ++-
|
|
|
f686d7 |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
f686d7 |
|
|
|
f686d7 |
diff --git a/Src/exec.c b/Src/exec.c
|
|
|
f686d7 |
index b9ffb35..f20b96c 100644
|
|
|
f686d7 |
--- a/Src/exec.c
|
|
|
f686d7 |
+++ b/Src/exec.c
|
|
|
f686d7 |
@@ -465,9 +465,10 @@ zexecve(char *pth, char **argv, char **newenvp)
|
|
|
f686d7 |
if ((fd = open(pth, O_RDONLY|O_NOCTTY)) >= 0) {
|
|
|
f686d7 |
argv0 = *argv;
|
|
|
f686d7 |
*argv = pth;
|
|
|
f686d7 |
+ execvebuf[0] = '\0';
|
|
|
f686d7 |
ct = read(fd, execvebuf, POUNDBANGLIMIT);
|
|
|
f686d7 |
close(fd);
|
|
|
f686d7 |
- if (ct > 0) {
|
|
|
f686d7 |
+ if (ct >= 0) {
|
|
|
f686d7 |
if (execvebuf[0] == '#') {
|
|
|
f686d7 |
if (execvebuf[1] == '!') {
|
|
|
f686d7 |
for (t0 = 0; t0 != ct; t0++)
|
|
|
f686d7 |
--
|
|
|
f686d7 |
2.17.2
|
|
|
f686d7 |
|
|
|
f686d7 |
|
|
|
f686d7 |
From ddb6c5b4c0ab9c6a7404112d367f0c7cc400ceec Mon Sep 17 00:00:00 2001
|
|
|
f686d7 |
From: Anthony Sottile <asottile@umich.edu>
|
|
|
f686d7 |
Date: Mon, 3 Sep 2018 14:39:25 +0000
|
|
|
f686d7 |
Subject: [PATCH 2/2] CVE-2018-0502, CVE-2018-13259: Fix two security issues in
|
|
|
f686d7 |
shebang line parsing.
|
|
|
f686d7 |
|
|
|
f686d7 |
See NEWS for more information.
|
|
|
f686d7 |
|
|
|
f686d7 |
Patch by Anthony Sottile and Buck Evan.
|
|
|
f686d7 |
|
|
|
f686d7 |
Upstream-commit: 1c4c7b6a4d17294df028322b70c53803a402233d
|
|
|
f686d7 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
f686d7 |
---
|
|
|
f686d7 |
Src/exec.c | 32 ++++++++++++++++++--------------
|
|
|
f686d7 |
Test/A05execution.ztst | 22 ++++++++++++++++++++++
|
|
|
f686d7 |
2 files changed, 40 insertions(+), 14 deletions(-)
|
|
|
f686d7 |
|
|
|
f686d7 |
diff --git a/Src/exec.c b/Src/exec.c
|
|
|
f686d7 |
index f20b96c..c95667e 100644
|
|
|
f686d7 |
--- a/Src/exec.c
|
|
|
f686d7 |
+++ b/Src/exec.c
|
|
|
f686d7 |
@@ -427,7 +427,7 @@ execcursh(Estate state, int do_exec)
|
|
|
f686d7 |
|
|
|
f686d7 |
/* execve after handling $_ and #! */
|
|
|
f686d7 |
|
|
|
f686d7 |
-#define POUNDBANGLIMIT 64
|
|
|
f686d7 |
+#define POUNDBANGLIMIT 128
|
|
|
f686d7 |
|
|
|
f686d7 |
/**/
|
|
|
f686d7 |
static int
|
|
|
f686d7 |
@@ -465,18 +465,20 @@ zexecve(char *pth, char **argv, char **newenvp)
|
|
|
f686d7 |
if ((fd = open(pth, O_RDONLY|O_NOCTTY)) >= 0) {
|
|
|
f686d7 |
argv0 = *argv;
|
|
|
f686d7 |
*argv = pth;
|
|
|
f686d7 |
- execvebuf[0] = '\0';
|
|
|
f686d7 |
+ memset(execvebuf, '\0', POUNDBANGLIMIT + 1);
|
|
|
f686d7 |
ct = read(fd, execvebuf, POUNDBANGLIMIT);
|
|
|
f686d7 |
close(fd);
|
|
|
f686d7 |
if (ct >= 0) {
|
|
|
f686d7 |
- if (execvebuf[0] == '#') {
|
|
|
f686d7 |
- if (execvebuf[1] == '!') {
|
|
|
f686d7 |
- for (t0 = 0; t0 != ct; t0++)
|
|
|
f686d7 |
- if (execvebuf[t0] == '\n')
|
|
|
f686d7 |
- break;
|
|
|
f686d7 |
+ if (ct >= 2 && execvebuf[0] == '#' && execvebuf[1] == '!') {
|
|
|
f686d7 |
+ for (t0 = 0; t0 != ct; t0++)
|
|
|
f686d7 |
+ if (execvebuf[t0] == '\n')
|
|
|
f686d7 |
+ break;
|
|
|
f686d7 |
+ if (t0 == ct)
|
|
|
f686d7 |
+ zerr("%s: bad interpreter: %s: %e", pth,
|
|
|
f686d7 |
+ execvebuf + 2, eno);
|
|
|
f686d7 |
+ else {
|
|
|
f686d7 |
while (inblank(execvebuf[t0]))
|
|
|
f686d7 |
execvebuf[t0--] = '\0';
|
|
|
f686d7 |
- execvebuf[POUNDBANGLIMIT] = '\0';
|
|
|
f686d7 |
for (ptr = execvebuf + 2; *ptr && *ptr == ' '; ptr++);
|
|
|
f686d7 |
for (ptr2 = ptr; *ptr && *ptr != ' '; ptr++);
|
|
|
f686d7 |
if (eno == ENOENT) {
|
|
|
f686d7 |
@@ -485,9 +487,14 @@ zexecve(char *pth, char **argv, char **newenvp)
|
|
|
f686d7 |
*ptr = '\0';
|
|
|
f686d7 |
if (*ptr2 != '/' &&
|
|
|
f686d7 |
(pprog = pathprog(ptr2, NULL))) {
|
|
|
f686d7 |
- argv[-2] = ptr2;
|
|
|
f686d7 |
- argv[-1] = ptr + 1;
|
|
|
f686d7 |
- execve(pprog, argv - 2, newenvp);
|
|
|
f686d7 |
+ if (ptr == execvebuf + t0 + 1) {
|
|
|
f686d7 |
+ argv[-1] = ptr2;
|
|
|
f686d7 |
+ execve(pprog, argv - 1, newenvp);
|
|
|
f686d7 |
+ } else {
|
|
|
f686d7 |
+ argv[-2] = ptr2;
|
|
|
f686d7 |
+ argv[-1] = ptr + 1;
|
|
|
f686d7 |
+ execve(pprog, argv - 2, newenvp);
|
|
|
f686d7 |
+ }
|
|
|
f686d7 |
}
|
|
|
f686d7 |
zerr("%s: bad interpreter: %s: %e", pth, ptr2,
|
|
|
f686d7 |
eno);
|
|
|
f686d7 |
@@ -500,9 +507,6 @@ zexecve(char *pth, char **argv, char **newenvp)
|
|
|
f686d7 |
argv[-1] = ptr2;
|
|
|
f686d7 |
execve(ptr2, argv - 1, newenvp);
|
|
|
f686d7 |
}
|
|
|
f686d7 |
- } else if (eno == ENOEXEC) {
|
|
|
f686d7 |
- argv[-1] = "sh";
|
|
|
f686d7 |
- execve("/bin/sh", argv - 1, newenvp);
|
|
|
f686d7 |
}
|
|
|
f686d7 |
} else if (eno == ENOEXEC) {
|
|
|
f686d7 |
for (t0 = 0; t0 != ct; t0++)
|
|
|
f686d7 |
diff --git a/Test/A05execution.ztst b/Test/A05execution.ztst
|
|
|
f686d7 |
index 0804691..fb39d05 100644
|
|
|
f686d7 |
--- a/Test/A05execution.ztst
|
|
|
f686d7 |
+++ b/Test/A05execution.ztst
|
|
|
f686d7 |
@@ -12,7 +12,14 @@
|
|
|
f686d7 |
|
|
|
f686d7 |
print '#!/bin/sh\necho This is dir2' >dir2/tstcmd
|
|
|
f686d7 |
|
|
|
f686d7 |
+ print -n '#!sh\necho This is slashless' >tstcmd-slashless
|
|
|
f686d7 |
+ print -n '#!echo foo\necho This is arg' >tstcmd-arg
|
|
|
f686d7 |
+ print '#!xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxnyyy' >tstcmd-interp-too-long
|
|
|
f686d7 |
+ print '#!/bin/sh\necho should not execute; exit 1' >xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxn
|
|
|
f686d7 |
+
|
|
|
f686d7 |
chmod 755 tstcmd dir1/tstcmd dir2/tstcmd
|
|
|
f686d7 |
+ chmod 755 tstcmd-slashless tstcmd-arg tstcmd-interp-too-long
|
|
|
f686d7 |
+ chmod 755 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxn
|
|
|
f686d7 |
|
|
|
f686d7 |
%test
|
|
|
f686d7 |
./tstcmd
|
|
|
f686d7 |
@@ -33,6 +40,21 @@
|
|
|
f686d7 |
0:path (2)
|
|
|
f686d7 |
>This is top
|
|
|
f686d7 |
|
|
|
f686d7 |
+ PATH=/bin:${ZTST_testdir}/command.tmp/ tstcmd-slashless
|
|
|
f686d7 |
+0:path (3)
|
|
|
f686d7 |
+>This is slashless
|
|
|
f686d7 |
+
|
|
|
f686d7 |
+ PATH=/bin:${ZTST_testdir}/command.tmp tstcmd-arg
|
|
|
f686d7 |
+0:path (4)
|
|
|
f686d7 |
+*>foo */command.tmp/tstcmd-arg
|
|
|
f686d7 |
+
|
|
|
f686d7 |
+ path=(/bin ${ZTST_testdir}/command.tmp/)
|
|
|
f686d7 |
+ tstcmd-interp-too-long 2>&1; echo "status $?"
|
|
|
f686d7 |
+ path=($storepath)
|
|
|
f686d7 |
+0:path (5)
|
|
|
f686d7 |
+*>*tstcmd-interp-too-long: bad interpreter: x*xn: no such file or directory
|
|
|
f686d7 |
+>status 127
|
|
|
f686d7 |
+
|
|
|
f686d7 |
functst() { print $# arguments:; print -l $*; }
|
|
|
f686d7 |
functst "Eines Morgens" "als Gregor Samsa"
|
|
|
f686d7 |
functst ""
|
|
|
f686d7 |
--
|
|
|
f686d7 |
2.17.1
|
|
|
f686d7 |
|