BASH PATCH REPORT
=================
Bash-Release: 2.05b
Patch-ID: bash205b-013
Bug-Reported-by: Michal Zalewski <
[email protected]>
Bug-Reference-ID:
Bug-Reference-URL:
Bug-Description:
A combination of nested command substitutions and function importing from
the environment can cause bash to execute code appearing in the environment
variable value following the function definition.
Patch:
*** ../bash-2.05b.12/builtins/evalstring.c 2014-09-25 10:18:20.000000000 -0400
--- builtins/evalstring.c 2014-10-04 16:33:35.000000000 -0400
***************
*** 205,214 ****
struct fd_bitmap *bitmap;
! if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)
{
! internal_warning ("%s: ignoring function definition attempt", from_file);
! should_jump_to_top_level = 0;
! last_result = last_command_exit_value = EX_BADUSAGE;
! break;
}
--- 205,227 ----
struct fd_bitmap *bitmap;
! if (flags & SEVAL_FUNCDEF)
{
! char *x;
!
! /* If the command parses to something other than a straight
! function definition, or if we have not consumed the entire
! string, or if the parser has transformed the function
! name (as parsing will if it begins or ends with shell
! whitespace, for example), reject the attempt */
! if (command->type != cm_function_def ||
! ((x = parser_remaining_input ()) && *x) ||
! (STREQ (from_file, command->value.Function_def->name->word) == 0))
! {
! internal_warning ("%s: ignoring function definition attempt", from_file);
! should_jump_to_top_level = 0;
! last_result = last_command_exit_value = EX_BADUSAGE;
! reset_parser ();
! break;
! }
}
***************
*** 266,270 ****
if (flags & SEVAL_ONECMD)
! break;
}
}
--- 279,286 ----
if (flags & SEVAL_ONECMD)
! {
! reset_parser ();
! break;
! }
}
}
*** ../bash-2.05b.12/parse.y 2014-09-30 20:11:38.000000000 -0400
--- parse.y 2014-10-04 16:28:49.000000000 -0400
***************
*** 1993,1996 ****
--- 1993,2006 ----
}
+ char *
+ parser_remaining_input ()
+ {
+ if (shell_input_line == 0)
+ return 0;
+ if (shell_input_line_index < 0 || shell_input_line_index >= shell_input_line_len)
+ return '\0'; /* XXX */
+ return (shell_input_line + shell_input_line_index);
+ }
+
#ifdef INCLUDE_UNUSED
/* Back the input pointer up by one, effectively `ungetting' a character. */
*** ../bash-2.05b.12/shell.h 2002-03-07 16:59:10.000000000 -0500
--- shell.h 2014-10-04 16:28:49.000000000 -0400
***************
*** 120,121 ****
--- 120,123 ----
# define USE_VAR(x)
#endif
+ extern char *parser_remaining_input __P((void));
+
