BASH PATCH REPORT

			     =================

Bash-Release:	4.3

Patch-ID:	bash43-030

Bug-Reported-by:	Michal Zalewski <[email protected]>

Bug-Reference-ID:

Bug-Reference-URL:

Bug-Description:

A combination of nested command substitutions and function importing from

the environment can cause bash to execute code appearing in the environment

variable value following the function definition.

Patch (apply with `patch -p0'):

*** ../bash-4.3.29/builtins/evalstring.c	2014-10-01 12:57:47.000000000 -0400

--- builtins/evalstring.c	2014-10-03 11:57:04.000000000 -0400

***************

*** 309,318 ****

  	      struct fd_bitmap *bitmap;

! 	      if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)

  		{

! 		  internal_warning ("%s: ignoring function definition attempt", from_file);

! 		  should_jump_to_top_level = 0;

! 		  last_result = last_command_exit_value = EX_BADUSAGE;

! 		  break;

  		}

--- 313,335 ----

  	      struct fd_bitmap *bitmap;

! 	      if (flags & SEVAL_FUNCDEF)

  		{

! 		  char *x;

! 

! 		  /* If the command parses to something other than a straight

! 		     function definition, or if we have not consumed the entire

! 		     string, or if the parser has transformed the function

! 		     name (as parsing will if it begins or ends with shell

! 		     whitespace, for example), reject the attempt */

! 		  if (command->type != cm_function_def ||

! 		      ((x = parser_remaining_input ()) && *x) ||

! 		      (STREQ (from_file, command->value.Function_def->name->word) == 0))

! 		    {

! 		      internal_warning (_("%s: ignoring function definition attempt"), from_file);

! 		      should_jump_to_top_level = 0;

! 		      last_result = last_command_exit_value = EX_BADUSAGE;

! 		      reset_parser ();

! 		      break;

! 		    }

  		}

***************

*** 379,383 ****

  	      if (flags & SEVAL_ONECMD)

! 		break;

  	    }

  	}

--- 396,403 ----

  	      if (flags & SEVAL_ONECMD)

! 		{

! 		  reset_parser ();

! 		  break;

! 		}

  	    }

  	}

*** ../bash-4.3.29/parse.y	2014-10-01 12:58:43.000000000 -0400

--- parse.y	2014-10-03 14:48:59.000000000 -0400

***************

*** 2539,2542 ****

--- 2539,2552 ----

  }

+ char *

+ parser_remaining_input ()

+ {

+   if (shell_input_line == 0)

+     return 0;

+   if (shell_input_line_index < 0 || shell_input_line_index >= shell_input_line_len)

+     return '\0';	/* XXX */

+   return (shell_input_line + shell_input_line_index);

+ }

+ 

  #ifdef INCLUDE_UNUSED

  /* Back the input pointer up by one, effectively `ungetting' a character. */

***************

*** 4028,4033 ****

    /* reset_parser clears shell_input_line and associated variables */

    restore_input_line_state (&ls);

!   if (interactive)

!     token_to_read = 0;

    /* Need to find how many characters parse_and_execute consumed, update

--- 4053,4058 ----

    /* reset_parser clears shell_input_line and associated variables */

    restore_input_line_state (&ls);

! 

!   token_to_read = 0;

    /* Need to find how many characters parse_and_execute consumed, update

*** ../bash-4.3.29/shell.h	2014-10-01 12:57:39.000000000 -0400

--- shell.h	2014-10-03 14:49:12.000000000 -0400

***************

*** 181,184 ****

--- 181,186 ----

  /* Let's try declaring these here. */

+ extern char *parser_remaining_input __P((void));

+ 

  extern sh_parser_state_t *save_parser_state __P((sh_parser_state_t *));

  extern void restore_parser_state __P((sh_parser_state_t *));

*** ../bash-4.3.28/y.tab.c	2014-10-01 13:09:46.000000000 -0400

--- y.tab.c	2014-10-04 19:26:22.000000000 -0400

***************

*** 169,173 ****

  /* Copy the first part of user declarations.  */

! #line 21 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

  #include "config.h"

--- 169,173 ----

  /* Copy the first part of user declarations.  */

! #line 21 "/usr/src/local/bash/bash-4.3-patched/parse.y"

  #include "config.h"

***************

*** 498,502 ****

  #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED

  typedef union YYSTYPE

! #line 329 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

  {

    WORD_DESC *word;		/* the word that we read. */

--- 498,502 ----

  #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED

  typedef union YYSTYPE

! #line 329 "/usr/src/local/bash/bash-4.3-patched/parse.y"

  {

    WORD_DESC *word;		/* the word that we read. */

***************

*** 2099,2103 ****

      {

          case 2:

! #line 383 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  /* Case of regular command.  Discard the error

--- 2099,2103 ----

      {

          case 2:

! #line 383 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  /* Case of regular command.  Discard the error

***************

*** 2113,2117 ****

    case 3:

! #line 394 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  /* Case of regular command, but not a very

--- 2113,2117 ----

    case 3:

! #line 394 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  /* Case of regular command, but not a very

***************

*** 2125,2129 ****

    case 4:

! #line 403 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  /* Error during parsing.  Return NULL command. */

--- 2125,2129 ----

    case 4:

! #line 403 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  /* Error during parsing.  Return NULL command. */

***************

*** 2143,2147 ****

    case 5:

! #line 418 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  /* Case of EOF seen by itself.  Do ignoreeof or

--- 2143,2147 ----

    case 5:

! #line 418 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  /* Case of EOF seen by itself.  Do ignoreeof or

***************

*** 2154,2168 ****

    case 6:

! #line 428 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      { (yyval.word_list) = make_word_list ((yyvsp[(1) - (1)].word), (WORD_LIST *)NULL); }

      break;

    case 7:

! #line 430 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      { (yyval.word_list) = make_word_list ((yyvsp[(2) - (2)].word), (yyvsp[(1) - (2)].word_list)); }

      break;

    case 8:

! #line 434 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 1;

--- 2154,2168 ----

    case 6:

! #line 428 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      { (yyval.word_list) = make_word_list ((yyvsp[(1) - (1)].word), (WORD_LIST *)NULL); }

      break;

    case 7:

! #line 430 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      { (yyval.word_list) = make_word_list ((yyvsp[(2) - (2)].word), (yyvsp[(1) - (2)].word_list)); }

      break;

    case 8:

! #line 434 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = 1;

***************

*** 2173,2177 ****

    case 9:

! #line 440 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 0;

--- 2173,2177 ----

    case 9:

! #line 440 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = 0;

***************

*** 2182,2186 ****

    case 10:

! #line 446 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2182,2186 ----

    case 10:

! #line 446 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2191,2195 ****

    case 11:

! #line 452 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2191,2195 ----

    case 11:

! #line 452 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2200,2204 ****

    case 12:

! #line 458 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2200,2204 ----

    case 12:

! #line 458 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2209,2213 ****

    case 13:

! #line 464 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2209,2213 ----

    case 13:

! #line 464 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2218,2222 ****

    case 14:

! #line 470 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 1;

--- 2218,2222 ----

    case 14:

! #line 470 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = 1;

***************

*** 2227,2231 ****

    case 15:

! #line 476 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2227,2231 ----

    case 15:

! #line 476 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2236,2240 ****

    case 16:

! #line 482 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2236,2240 ----

    case 16:

! #line 482 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2245,2249 ****

    case 17:

! #line 488 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 1;

--- 2245,2249 ----

    case 17:

! #line 488 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = 1;

***************

*** 2254,2258 ****

    case 18:

! #line 494 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2254,2258 ----

    case 18:

! #line 494 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2263,2267 ****

    case 19:

! #line 500 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2263,2267 ----

    case 19:

! #line 500 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2272,2276 ****

    case 20:

! #line 506 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 0;

--- 2272,2276 ----

    case 20:

! #line 506 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = 0;

***************

*** 2281,2285 ****

    case 21:

! #line 512 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2281,2285 ----

    case 21:

! #line 512 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2290,2294 ****

    case 22:

! #line 518 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2290,2294 ----

    case 22:

! #line 518 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2299,2303 ****

    case 23:

! #line 524 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 0;

--- 2299,2303 ----

    case 23:

! #line 524 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = 0;

***************

*** 2309,2313 ****

    case 24:

! #line 531 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2309,2313 ----

    case 24:

! #line 531 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2319,2323 ****

    case 25:

! #line 538 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2319,2323 ----

    case 25:

! #line 538 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2329,2333 ****

    case 26:

! #line 545 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 0;

--- 2329,2333 ----

    case 26:

! #line 545 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = 0;

***************

*** 2339,2343 ****

    case 27:

! #line 552 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2339,2343 ----

    case 27:

! #line 552 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2349,2353 ****

    case 28:

! #line 559 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2349,2353 ----

    case 28:

! #line 559 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

***************

*** 2359,2363 ****

    case 29:

! #line 566 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = 0;

--- 2359,2363 ----

    case 29:

! #line 566 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = 0;

***************

*** 2368,2372 ****

    case 30:

! #line 572 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

--- 2368,2372 ----

    case 30:

! #line 572 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.dest = (yyvsp[(1) - (3)].number);

***************

*** 2377,2381 ****

    case 31:

! #line 578 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);

--- 2377,2381 ----

    case 31:

! #line 578 "/usr/src/local/bash/bash-4.3-patched/parse.y"

      {

  			  source.filename = (yyvsp[(1) - (3)].word);