Shellshock: Πολύ σοβαρό κενό ασφαλείας σε συστήματα Linux και OS X

Patches from latest RedHat packages.


fg!


----- CUT HERE ------
diff -ur bash-92/bash-3.2/builtins/common.h bash-92-patched/bash-3.2/builtins/common.h
--- bash-92/bash-3.2/builtins/common.h 2009-06-12 00:29:43.000000000 +0100
+++ bash-92-patched/bash-3.2/builtins/common.h 2014-09-24 21:46:44.000000000 +0100
@@ -33,6 +33,8 @@
 #define SEVAL_RESETLINE 0x010


 /* Flags for describe_command, shared between type.def and command.def */
+#define SEVAL_FUNCDEF 0x080 /* only allow function definitions */
+#define SEVAL_ONECMD 0x100 /* only allow a single command */
 #define CDESC_ALL 0x001 /* type -a */
 #define CDESC_SHORTDESC 0x002 /* command -V */
 #define CDESC_REUSABLE 0x004 /* command -v */
diff -ur bash-92/bash-3.2/builtins/evalstring.c bash-92-patched/bash-3.2/builtins/evalstring.c
--- bash-92/bash-3.2/builtins/evalstring.c 2009-06-12 00:29:43.000000000 +0100
+++ bash-92-patched/bash-3.2/builtins/evalstring.c 2014-09-24 21:48:05.000000000 +0100
@@ -234,6 +234,14 @@
      {
        struct fd_bitmap *bitmap;


+            if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)
+            {
+                internal_warning ("%s: ignoring function definition attempt", from_file);
+                should_jump_to_top_level = 0;
+                last_result = last_command_exit_value = EX_BADUSAGE;
+                break;
+            }
+
        bitmap = new_fd_bitmap (FD_BITMAP_SIZE);
        begin_unwind_frame ("pe_dispose");
        add_unwind_protect (dispose_fd_bitmap, bitmap);
@@ -291,6 +299,8 @@
        dispose_command (command);
        dispose_fd_bitmap (bitmap);
        discard_unwind_frame ("pe_dispose");
+          if (flags & SEVAL_ONECMD)
+              break;
      }
  }
       else
diff -ur bash-92/bash-3.2/parse.y bash-92-patched/bash-3.2/parse.y
--- bash-92/bash-3.2/parse.y 2013-01-22 01:37:34.000000000 +0000
+++ bash-92-patched/bash-3.2/parse.y 2014-09-26 10:00:36.000000000 +0100
@@ -253,9 +253,21 @@


 /* Variables to manage the task of reading here documents, because we need to
    defer the reading until after a complete command has been collected. */
-static REDIRECT *redir_stack[10];
+static REDIRECT **redir_stack;
 int need_here_doc;


+/* Pushes REDIR onto redir_stack, resizing it as needed. */
+static void
+push_redir_stack (REDIRECT *redir)
+{
+  /* Guard against oveflow. */
+  if (need_here_doc + 1 > INT_MAX / sizeof (*redir_stack))
+    abort ();
+  redir_stack = xrealloc (redir_stack,
+   (need_here_doc + 1) * sizeof (*redir_stack));
+  redir_stack[need_here_doc++] = redir;
+}
+
 /* Where shell input comes from.  History expansion is performed on each
    line when the shell is interactive. */
 static char *shell_input_line = (char *)NULL;
@@ -424,13 +436,13 @@
  {
    redir.filename = $2;
    $$ = make_redirection (0, r_reading_until, redir);
-   redir_stack[need_here_doc++] = $$;
+   push_redir_stack ($$);
  }
  | NUMBER LESS_LESS WORD
  {
    redir.filename = $3;
    $$ = make_redirection ($1, r_reading_until, redir);
-   redir_stack[need_here_doc++] = $$;
+   push_redir_stack ($$);
  }
  | LESS_LESS_LESS WORD
  {
@@ -487,14 +499,14 @@
    redir.filename = $2;
    $$ = make_redirection
      (0, r_deblank_reading_until, redir);
-   redir_stack[need_here_doc++] = $$;
+   push_redir_stack ($$);
  }
  | NUMBER LESS_LESS_MINUS WORD
  {
    redir.filename = $3;
    $$ = make_redirection
      ($1, r_deblank_reading_until, redir);
-   redir_stack[need_here_doc++] = $$;
+   push_redir_stack ($$);
  }
  | GREATER_AND '-'
  {
@@ -2503,6 +2515,8 @@
   FREE (word_desc_to_read);
   word_desc_to_read = (WORD_DESC *)NULL;


+  eol_ungetc_lookahead = 0;
+
   last_read_token = '\n';
   token_to_read = '\n';
 }
@@ -3767,7 +3781,7 @@
     case CASE:
     case SELECT:
     case FOR:
-      if (word_top < MAX_CASE_NEST)
+      if (word_top + 1 < MAX_CASE_NEST)
  word_top++;
       word_lineno[word_top] = line_number;
       break;
diff -ur bash-92/bash-3.2/patchlevel.h bash-92-patched/bash-3.2/patchlevel.h
--- bash-92/bash-3.2/patchlevel.h 2013-01-22 01:37:34.000000000 +0000
+++ bash-92-patched/bash-3.2/patchlevel.h 2014-09-24 21:50:51.000000000 +0100
@@ -25,6 +25,6 @@
    regexp `^#define[  ]*PATCHLEVEL', since that's what support/mkversion.sh
    looks for to find the patch level (for the sccs version string). */


-#define PATCHLEVEL 51
+#define PATCHLEVEL 52


 #endif /* _PATCHLEVEL_H_ */
diff -ur bash-92/bash-3.2/variables.c bash-92-patched/bash-3.2/variables.c
--- bash-92/bash-3.2/variables.c 2009-06-12 00:29:43.000000000 +0100
+++ bash-92-patched/bash-3.2/variables.c 2014-09-26 10:07:54.000000000 +0100
@@ -241,7 +241,7 @@
 static void propagate_temp_var __P((PTR_T));
 static void dispose_temporary_env __P((sh_free_func_t *));


-static inline char *mk_env_string __P((const char *, const char *));
+static inline char *mk_env_string __P((const char *, const char *, int));
 static char **make_env_array_from_var_list __P((SHELL_VAR **));
 static char **make_var_export_array __P((VAR_CONTEXT *));
 static char **make_func_export_array __P((void));
@@ -274,6 +274,11 @@
 #endif
 }


+#define FUNCDEF_PREFIX "BASH_FUNC_"
+#define FUNCDEF_PREFIX_LEN (strlen (FUNCDEF_PREFIX))
+#define FUNCDEF_SUFFIX "()"
+#define FUNCDEF_SUFFIX_LEN (strlen (FUNCDEF_SUFFIX))
+
 /* Initialize the shell variables from the current environment.
    If PRIVMODE is nonzero, don't import functions from ENV or
    parse $SHELLOPTS. */
@@ -309,23 +314,30 @@


       /* If exported function, define it now.  Don't import functions from
   the environment in privileged mode. */
-      if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4))
- {
-   string_length = strlen (string);
-   temp_string = (char *)xmalloc (3 + string_length + char_index);
-
-   strcpy (temp_string, name);
-   temp_string[char_index] = ' ';
-   strcpy (temp_string + char_index + 1, string);
+      if (privmode == 0 && read_but_dont_execute == 0
+   && STREQN (FUNCDEF_PREFIX, name, FUNCDEF_PREFIX_LEN)
+   && STREQ (name + char_index - FUNCDEF_SUFFIX_LEN, FUNCDEF_SUFFIX)
+   && STREQN ("() {", string, 4))
+ {
+   size_t name_length
+     = char_index - (FUNCDEF_PREFIX_LEN + FUNCDEF_SUFFIX_LEN);
+   char *temp_name = name + FUNCDEF_PREFIX_LEN;
+   /* Temporarily remove the suffix. */
+   temp_name[name_length] = '\0';
+
+          string_length = strlen (string);
+   temp_string = (char *)xmalloc (name_length + 1 + string_length + 1);
+   memcpy (temp_string, temp_name, name_length);
+   temp_string[name_length] = ' ';
+   memcpy (temp_string + name_length + 1, string, string_length + 1);
+
+        /* Don't import function names that are invalid identifiers from the
+                environment. */
+   if (legal_identifier (temp_name))
+     parse_and_execute (temp_string, temp_name,
+        SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);


-   parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST);
-
-   /* Ancient backwards compatibility.  Old versions of bash exported
-      functions like name()=() {...} */
-   if (name[char_index - 1] == ')' && name[char_index - 2] == '(')
-     name[char_index - 2] = '\0';
-
-   if (temp_var = find_function (name))
+   if (temp_var = find_function (temp_name))
      {
        VSETATTR (temp_var, (att_exported|att_imported));
        array_needs_making = 1;
@@ -333,9 +345,9 @@
    else
      report_error (_("error importing function definition for `%s'"), name);


-   /* ( */
-   if (name[char_index - 1] == ')' && name[char_index - 2] == '\0')
-     name[char_index - 2] = '('; /* ) */
+   /* Restore the original suffix. */
+   temp_name[name_length] = FUNCDEF_SUFFIX[0];
+
  }
 #if defined (ARRAY_VARS)
 #  if 0
@@ -2213,7 +2225,7 @@
   var->context = variable_context; /* XXX */


   INVALIDATE_EXPORTSTR (var);
-  var->exportstr = mk_env_string (name, value);
+  var->exportstr = mk_env_string (name, value, 0);


   array_needs_making = 1;


@@ -3003,22 +3015,44 @@
 /*     */
 /* **************************************************************** */


+/* Returns the string NAME=VALUE if !FUNCTIONP or if VALUE == NULL (in
+   which case it is treated as empty).  Otherwise, decorate NAME with
+   FUNCDEF_PREFIX and FUNCDEF_SUFFIX, and return a string of the form
+   FUNCDEF_PREFIX NAME FUNCDEF_SUFFIX = VALUE (without spaces).  */
 static inline char *
-mk_env_string (name, value)
+mk_env_string (name, value, functionp)
      const char *name, *value;
+     int functionp;
 {
-  int name_len, value_len;
-  char *p;
+  size_t name_len, value_len;
+  char *p, *q;


   name_len = strlen (name);
   value_len = STRLEN (value);
-  p = (char *)xmalloc (2 + name_len + value_len);
-  strcpy (p, name);
-  p[name_len] = '=';
+  if (functionp && value != NULL)
+    {
+      p = (char *)xmalloc (FUNCDEF_PREFIX_LEN + name_len + FUNCDEF_SUFFIX_LEN
+    + 1 + value_len + 1);
+      q = p;
+      memcpy (q, FUNCDEF_PREFIX, FUNCDEF_PREFIX_LEN);
+      q += FUNCDEF_PREFIX_LEN;
+      memcpy (q, name, name_len);
+      q += name_len;
+      memcpy (q, FUNCDEF_SUFFIX, FUNCDEF_SUFFIX_LEN);
+      q += FUNCDEF_SUFFIX_LEN;
+    }
+  else
+    {
+      p = (char *)xmalloc (name_len + 1 + value_len + 1);
+      memcpy (p, name, name_len);
+      q = p + name_len;
+    }
+  q[0] = '=';
+
   if (value && *value)
-    strcpy (p + name_len + 1, value);
+    memcpy (q + 1, value, value_len + 1);
   else
-    p[name_len + 1] = '\0';
+    q[1] = '\0';
   return (p);
 }


@@ -3093,7 +3127,7 @@
    /* Gee, I'd like to get away with not using savestring() if we're
       using the cached exportstr... */
    list[list_index] = USE_EXPORTSTR ? savestring (value)
-    : mk_env_string (var->name, value);
+    : mk_env_string (var->name, value, function_p (var));


    if (USE_EXPORTSTR == 0)
      SAVE_EXPORTSTR (var, list[list_index]);
----- CUT HERE ------