BASH PATCH REPORT

			     =================

Bash-Release:	4.3

Patch-ID:	bash43-028

Bug-Reported-by:	Florian Weimer <[email protected]>

Bug-Reference-ID:

Bug-Reference-URL:

Bug-Description:

There are two local buffer overflows in parse.y that can cause the shell

to dump core when given many here-documents attached to a single command

or many nested loops.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/parse.y	2014-09-25 23:02:35.000000000 -0400

--- parse.y	2014-09-29 16:47:03.000000000 -0400

***************

*** 169,172 ****

--- 169,175 ----

  static int reserved_word_acceptable __P((int));

  static int yylex __P((void));

+ 

+ static void push_heredoc __P((REDIRECT *));

+ static char *mk_alexpansion __P((char *));

  static int alias_expand_token __P((char *));

  static int time_command_acceptable __P((void));

***************

*** 266,270 ****

  /* Variables to manage the task of reading here documents, because we need to

     defer the reading until after a complete command has been collected. */

! static REDIRECT *redir_stack[10];

  int need_here_doc;

--- 269,275 ----

  /* Variables to manage the task of reading here documents, because we need to

     defer the reading until after a complete command has been collected. */

! #define HEREDOC_MAX 16

! 

! static REDIRECT *redir_stack[HEREDOC_MAX];

  int need_here_doc;

***************

*** 308,312 ****

     index is decremented after a case, select, or for command is parsed. */

  #define MAX_CASE_NEST	128

! static int word_lineno[MAX_CASE_NEST];

  static int word_top = -1;

--- 313,317 ----

     index is decremented after a case, select, or for command is parsed. */

  #define MAX_CASE_NEST	128

! static int word_lineno[MAX_CASE_NEST+1];

  static int word_top = -1;

***************

*** 521,525 ****

  			  redir.filename = $2;

  			  $$ = make_redirection (source, r_reading_until, redir, 0);

! 			  redir_stack[need_here_doc++] = $$;

  			}

  	|	NUMBER LESS_LESS WORD

--- 526,530 ----

  			  redir.filename = $2;

  			  $$ = make_redirection (source, r_reading_until, redir, 0);

! 			  push_heredoc ($$);

  			}

  	|	NUMBER LESS_LESS WORD

***************

*** 528,532 ****

  			  redir.filename = $3;

  			  $$ = make_redirection (source, r_reading_until, redir, 0);

! 			  redir_stack[need_here_doc++] = $$;

  			}

  	|	REDIR_WORD LESS_LESS WORD

--- 533,537 ----

  			  redir.filename = $3;

  			  $$ = make_redirection (source, r_reading_until, redir, 0);

! 			  push_heredoc ($$);

  			}

  	|	REDIR_WORD LESS_LESS WORD

***************

*** 535,539 ****

  			  redir.filename = $3;

  			  $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);

! 			  redir_stack[need_here_doc++] = $$;

  			}

  	|	LESS_LESS_MINUS WORD

--- 540,544 ----

  			  redir.filename = $3;

  			  $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);

! 			  push_heredoc ($$);

  			}

  	|	LESS_LESS_MINUS WORD

***************

*** 542,546 ****

  			  redir.filename = $2;

  			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);

! 			  redir_stack[need_here_doc++] = $$;

  			}

  	|	NUMBER LESS_LESS_MINUS WORD

--- 547,551 ----

  			  redir.filename = $2;

  			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);

! 			  push_heredoc ($$);

  			}

  	|	NUMBER LESS_LESS_MINUS WORD

***************

*** 549,553 ****

  			  redir.filename = $3;

  			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);

! 			  redir_stack[need_here_doc++] = $$;

  			}

  	|	REDIR_WORD  LESS_LESS_MINUS WORD

--- 554,558 ----

  			  redir.filename = $3;

  			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);

! 			  push_heredoc ($$);

  			}

  	|	REDIR_WORD  LESS_LESS_MINUS WORD

***************

*** 556,560 ****

  			  redir.filename = $3;

  			  $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);

! 			  redir_stack[need_here_doc++] = $$;

  			}

  	|	LESS_LESS_LESS WORD

--- 561,565 ----

  			  redir.filename = $3;

  			  $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);

! 			  push_heredoc ($$);

  			}

  	|	LESS_LESS_LESS WORD

***************

*** 2637,2640 ****

--- 2642,2660 ----

  static int esacs_needed_count;

+ static void

+ push_heredoc (r)

+      REDIRECT *r;

+ {

+   if (need_here_doc >= HEREDOC_MAX)

+     {

+       last_command_exit_value = EX_BADUSAGE;

+       need_here_doc = 0;

+       report_syntax_error (_("maximum here-document count exceeded"));

+       reset_parser ();

+       exit_shell (last_command_exit_value);

+     }

+   redir_stack[need_here_doc++] = r;

+ }

+ 

  void

  gather_here_documents ()

*** ../bash-4.3.27/y.tab.c	2014-10-01 11:38:24.000000000 -0400

--- y.tab.c	2014-10-01 12:46:11.000000000 -0400

***************

*** 169,173 ****

  /* Copy the first part of user declarations.  */

! #line 21 "/usr/homes/chet/src/bash/src/parse.y"

  #include "config.h"

--- 169,173 ----

  /* Copy the first part of user declarations.  */

! #line 21 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

  #include "config.h"

***************

*** 320,323 ****

--- 320,326 ----

  static int reserved_word_acceptable __P((int));

  static int yylex __P((void));

+ 

+ static void push_heredoc __P((REDIRECT *));

+ static char *mk_alexpansion __P((char *));

  static int alias_expand_token __P((char *));

  static int time_command_acceptable __P((void));

***************

*** 417,421 ****

  /* Variables to manage the task of reading here documents, because we need to

     defer the reading until after a complete command has been collected. */

! static REDIRECT *redir_stack[10];

  int need_here_doc;

--- 420,426 ----

  /* Variables to manage the task of reading here documents, because we need to

     defer the reading until after a complete command has been collected. */

! #define HEREDOC_MAX 16

! 

! static REDIRECT *redir_stack[HEREDOC_MAX];

  int need_here_doc;

***************

*** 459,463 ****

     index is decremented after a case, select, or for command is parsed. */

  #define MAX_CASE_NEST	128

! static int word_lineno[MAX_CASE_NEST];

  static int word_top = -1;

--- 464,468 ----

     index is decremented after a case, select, or for command is parsed. */

  #define MAX_CASE_NEST	128

! static int word_lineno[MAX_CASE_NEST+1];

  static int word_top = -1;

***************

*** 493,497 ****

  #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED

  typedef union YYSTYPE

! #line 324 "/usr/homes/chet/src/bash/src/parse.y"

  {

    WORD_DESC *word;		/* the word that we read. */

--- 498,502 ----

  #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED

  typedef union YYSTYPE

! #line 329 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

  {

    WORD_DESC *word;		/* the word that we read. */

***************

*** 504,508 ****

  }

  /* Line 193 of yacc.c.  */

! #line 507 "y.tab.c"

  	YYSTYPE;

  # define yystype YYSTYPE /* obsolescent; will be withdrawn */

--- 509,513 ----

  }

  /* Line 193 of yacc.c.  */

! #line 512 "y.tab.c"

  	YYSTYPE;

  # define yystype YYSTYPE /* obsolescent; will be withdrawn */

***************

*** 517,521 ****

  /* Line 216 of yacc.c.  */

! #line 520 "y.tab.c"

  #ifdef short

--- 522,526 ----

  /* Line 216 of yacc.c.  */

! #line 525 "y.tab.c"

  #ifdef short

***************

*** 887,907 ****

  static const yytype_uint16 yyrline[] =

  {

!        0,   377,   377,   388,   397,   412,   422,   424,   428,   434,

!      440,   446,   452,   458,   464,   470,   476,   482,   488,   494,

!      500,   506,   512,   518,   525,   532,   539,   546,   553,   560,

!      566,   572,   578,   584,   590,   596,   602,   608,   614,   620,

!      626,   632,   638,   644,   650,   656,   662,   668,   674,   680,

!      686,   692,   700,   702,   704,   708,   712,   723,   725,   729,

!      731,   733,   749,   751,   755,   757,   759,   761,   763,   765,

!      767,   769,   771,   773,   775,   779,   784,   789,   794,   799,

!      804,   809,   814,   821,   826,   831,   836,   843,   848,   853,

!      858,   863,   868,   875,   880,   885,   892,   895,   898,   902,

!      904,   935,   942,   947,   964,   969,   986,   993,   995,   997,

!     1002,  1006,  1010,  1014,  1016,  1018,  1022,  1023,  1027,  1029,

!     1031,  1033,  1037,  1039,  1041,  1043,  1045,  1047,  1051,  1053,

!     1062,  1070,  1071,  1077,  1078,  1085,  1089,  1091,  1093,  1100,

!     1102,  1104,  1108,  1109,  1112,  1114,  1116,  1120,  1121,  1130,

!     1143,  1159,  1174,  1176,  1178,  1185,  1188,  1192,  1194,  1200,

!     1206,  1223,  1243,  1245,  1268,  1272,  1274,  1276

  };

  #endif

--- 892,912 ----

  static const yytype_uint16 yyrline[] =

  {

!        0,   382,   382,   393,   402,   417,   427,   429,   433,   439,

!      445,   451,   457,   463,   469,   475,   481,   487,   493,   499,

!      505,   511,   517,   523,   530,   537,   544,   551,   558,   565,

!      571,   577,   583,   589,   595,   601,   607,   613,   619,   625,

!      631,   637,   643,   649,   655,   661,   667,   673,   679,   685,

!      691,   697,   705,   707,   709,   713,   717,   728,   730,   734,

!      736,   738,   754,   756,   760,   762,   764,   766,   768,   770,

!      772,   774,   776,   778,   780,   784,   789,   794,   799,   804,

!      809,   814,   819,   826,   831,   836,   841,   848,   853,   858,

!      863,   868,   873,   880,   885,   890,   897,   900,   903,   907,

!      909,   940,   947,   952,   969,   974,   991,   998,  1000,  1002,

!     1007,  1011,  1015,  1019,  1021,  1023,  1027,  1028,  1032,  1034,

!     1036,  1038,  1042,  1044,  1046,  1048,  1050,  1052,  1056,  1058,

!     1067,  1075,  1076,  1082,  1083,  1090,  1094,  1096,  1098,  1105,

!     1107,  1109,  1113,  1114,  1117,  1119,  1121,  1125,  1126,  1135,

!     1148,  1164,  1179,  1181,  1183,  1190,  1193,  1197,  1199,  1205,

!     1211,  1228,  1248,  1250,  1273,  1277,  1279,  1281

  };

  #endif

***************

*** 2094,2098 ****

      {

          case 2:

! #line 378 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  /* Case of regular command.  Discard the error

--- 2099,2103 ----

      {

          case 2:

! #line 383 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  /* Case of regular command.  Discard the error

***************

*** 2108,2112 ****

    case 3:

! #line 389 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  /* Case of regular command, but not a very

--- 2113,2117 ----

    case 3:

! #line 394 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  /* Case of regular command, but not a very

***************

*** 2120,2124 ****

    case 4:

! #line 398 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  /* Error during parsing.  Return NULL command. */

--- 2125,2129 ----

    case 4:

! #line 403 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  /* Error during parsing.  Return NULL command. */

***************

*** 2138,2142 ****

    case 5:

! #line 413 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  /* Case of EOF seen by itself.  Do ignoreeof or

--- 2143,2147 ----

    case 5:

! #line 418 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  /* Case of EOF seen by itself.  Do ignoreeof or

***************

*** 2149,2163 ****

    case 6:

! #line 423 "/usr/homes/chet/src/bash/src/parse.y"

      { (yyval.word_list) = make_word_list ((yyvsp[(1) - (1)].word), (WORD_LIST *)NULL); }

      break;

    case 7:

! #line 425 "/usr/homes/chet/src/bash/src/parse.y"

      { (yyval.word_list) = make_word_list ((yyvsp[(2) - (2)].word), (yyvsp[(1) - (2)].word_list)); }

      break;

    case 8:

! #line 429 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.dest = 1;

--- 2154,2168 ----

    case 6:

! #line 428 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      { (yyval.word_list) = make_word_list ((yyvsp[(1) - (1)].word), (WORD_LIST *)NULL); }

      break;

    case 7:

! #line 430 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      { (yyval.word_list) = make_word_list ((yyvsp[(2) - (2)].word), (yyvsp[(1) - (2)].word_list)); }

      break;

    case 8:

! #line 434 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 1;

***************

*** 2168,2172 ****

    case 9:

! #line 435 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.dest = 0;

--- 2173,2177 ----

    case 9:

! #line 440 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 0;

***************

*** 2177,2181 ****

    case 10:

! #line 441 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2182,2186 ----

    case 10:

! #line 446 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2186,2190 ****

    case 11:

! #line 447 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2191,2195 ----

    case 11:

! #line 452 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2195,2199 ****

    case 12:

! #line 453 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2200,2204 ----

    case 12:

! #line 458 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2204,2208 ****

    case 13:

! #line 459 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2209,2213 ----

    case 13:

! #line 464 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2213,2217 ****

    case 14:

! #line 465 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.dest = 1;

--- 2218,2222 ----

    case 14:

! #line 470 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 1;

***************

*** 2222,2226 ****

    case 15:

! #line 471 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2227,2231 ----

    case 15:

! #line 476 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2231,2235 ****

    case 16:

! #line 477 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2236,2240 ----

    case 16:

! #line 482 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2240,2244 ****

    case 17:

! #line 483 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.dest = 1;

--- 2245,2249 ----

    case 17:

! #line 488 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 1;

***************

*** 2249,2253 ****

    case 18:

! #line 489 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2254,2258 ----

    case 18:

! #line 494 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2258,2262 ****

    case 19:

! #line 495 "/usr/homes/chet/src/bash/src/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2263,2267 ----

    case 19:

! #line 500 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2267,2271 ****

    case 20:

! #line 501 "/usr/homes/chet/src/bash/src/parse.y"

      {