components/bash/patches/parser-oob-4.1.patch
author Stefan Teleman <stefan.teleman@oracle.com>
Fri, 26 Sep 2014 07:32:09 -0700
branchs11u2-sru
changeset 3346 0e90925e4557
permissions -rw-r--r--
19690348 problem in UTILITY/BASH
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
3346
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
     1
# Patch Origin: http://www.openwall.com/lists/oss-security/2014/09/26/2
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
     2
# Patch is from Red Hat Security.
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
     3
# Assigned CVE-2014-7186 and CVE-2014-7187
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
     4
# CVSS Score: 4.6
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
     5
--- ../bash-4.1.orig/parse.y	2014-09-25 08:10:49.809021000 -0700
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
     6
+++ parse.y	2014-09-25 11:33:15.596573700 -0700
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
     7
@@ -261,9 +261,21 @@
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
     8
 
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
     9
 /* Variables to manage the task of reading here documents, because we need to
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    10
    defer the reading until after a complete command has been collected. */
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    11
-static REDIRECT *redir_stack[10];
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    12
+static REDIRECT **redir_stack;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    13
 int need_here_doc;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    14
 
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    15
+/* Pushes REDIR onto redir_stack, resizing it as needed. */
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    16
+static void
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    17
+push_redir_stack (REDIRECT *redir)
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    18
+{
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    19
+  /* Guard against oveflow. */
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    20
+  if (need_here_doc + 1 > INT_MAX / sizeof (*redir_stack))
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    21
+    abort ();
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    22
+  redir_stack = xrealloc (redir_stack,
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    23
+             (need_here_doc + 1) * sizeof (*redir_stack));
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    24
+  redir_stack[need_here_doc++] = redir;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    25
+}
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    26
+
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    27
 /* Where shell input comes from.  History expansion is performed on each
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    28
    line when the shell is interactive. */
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    29
 static char *shell_input_line = (char *)NULL;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    30
@@ -516,42 +528,42 @@
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    31
 			  source.dest = 0;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    32
 			  redir.filename = $2;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    33
 			  $$ = make_redirection (source, r_reading_until, redir, 0);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    34
-			  redir_stack[need_here_doc++] = $$;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    35
+                          push_redir_stack ($$);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    36
 			}
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    37
 	|	NUMBER LESS_LESS WORD
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    38
 			{
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    39
 			  source.dest = $1;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    40
 			  redir.filename = $3;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    41
 			  $$ = make_redirection (source, r_reading_until, redir, 0);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    42
-			  redir_stack[need_here_doc++] = $$;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    43
+                          push_redir_stack ($$);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    44
 			}
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    45
 	|	REDIR_WORD LESS_LESS WORD
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    46
 			{
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    47
 			  source.filename = $1;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    48
 			  redir.filename = $3;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    49
 			  $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    50
-			  redir_stack[need_here_doc++] = $$;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    51
+                          push_redir_stack ($$);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    52
 			}
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    53
 	|	LESS_LESS_MINUS WORD
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    54
 			{
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    55
 			  source.dest = 0;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    56
 			  redir.filename = $2;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    57
 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    58
-			  redir_stack[need_here_doc++] = $$;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    59
+                          push_redir_stack ($$);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    60
 			}
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    61
 	|	NUMBER LESS_LESS_MINUS WORD
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    62
 			{
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    63
 			  source.dest = $1;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    64
 			  redir.filename = $3;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    65
 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    66
-			  redir_stack[need_here_doc++] = $$;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    67
+                          push_redir_stack ($$);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    68
 			}
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    69
 	|	REDIR_WORD  LESS_LESS_MINUS WORD
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    70
 			{
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    71
 			  source.filename = $1;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    72
 			  redir.filename = $3;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    73
 			  $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    74
-			  redir_stack[need_here_doc++] = $$;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    75
+                          push_redir_stack ($$);
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    76
 			}
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    77
 	|	LESS_LESS_LESS WORD
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    78
 			{
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    79
@@ -4677,7 +4689,7 @@
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    80
     case CASE:
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    81
     case SELECT:
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    82
     case FOR:
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    83
-      if (word_top < MAX_CASE_NEST)
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    84
+      if ((word_top + 1) < MAX_CASE_NEST)
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    85
 	word_top++;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    86
       word_lineno[word_top] = line_number;
0e90925e4557 19690348 problem in UTILITY/BASH
Stefan Teleman <stefan.teleman@oracle.com>
parents:
diff changeset
    87
       break;