components/bash/patches/parser-oob-4.1.patch
branchs11u2-sru
changeset 3346 0e90925e4557
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/bash/patches/parser-oob-4.1.patch	Fri Sep 26 07:32:09 2014 -0700
@@ -0,0 +1,87 @@
+# Patch Origin: http://www.openwall.com/lists/oss-security/2014/09/26/2
+# Patch is from Red Hat Security.
+# Assigned CVE-2014-7186 and CVE-2014-7187
+# CVSS Score: 4.6
+--- ../bash-4.1.orig/parse.y	2014-09-25 08:10:49.809021000 -0700
++++ parse.y	2014-09-25 11:33:15.596573700 -0700
[email protected]@ -261,9 +261,21 @@
+ 
+ /* Variables to manage the task of reading here documents, because we need to
+    defer the reading until after a complete command has been collected. */
+-static REDIRECT *redir_stack[10];
++static REDIRECT **redir_stack;
+ int need_here_doc;
+ 
++/* Pushes REDIR onto redir_stack, resizing it as needed. */
++static void
++push_redir_stack (REDIRECT *redir)
++{
++  /* Guard against oveflow. */
++  if (need_here_doc + 1 > INT_MAX / sizeof (*redir_stack))
++    abort ();
++  redir_stack = xrealloc (redir_stack,
++             (need_here_doc + 1) * sizeof (*redir_stack));
++  redir_stack[need_here_doc++] = redir;
++}
++
+ /* Where shell input comes from.  History expansion is performed on each
+    line when the shell is interactive. */
+ static char *shell_input_line = (char *)NULL;
[email protected]@ -516,42 +528,42 @@
+ 			  source.dest = 0;
+ 			  redir.filename = $2;
+ 			  $$ = make_redirection (source, r_reading_until, redir, 0);
+-			  redir_stack[need_here_doc++] = $$;
++                          push_redir_stack ($$);
+ 			}
+ 	|	NUMBER LESS_LESS WORD
+ 			{
+ 			  source.dest = $1;
+ 			  redir.filename = $3;
+ 			  $$ = make_redirection (source, r_reading_until, redir, 0);
+-			  redir_stack[need_here_doc++] = $$;
++                          push_redir_stack ($$);
+ 			}
+ 	|	REDIR_WORD LESS_LESS WORD
+ 			{
+ 			  source.filename = $1;
+ 			  redir.filename = $3;
+ 			  $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
+-			  redir_stack[need_here_doc++] = $$;
++                          push_redir_stack ($$);
+ 			}
+ 	|	LESS_LESS_MINUS WORD
+ 			{
+ 			  source.dest = 0;
+ 			  redir.filename = $2;
+ 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
+-			  redir_stack[need_here_doc++] = $$;
++                          push_redir_stack ($$);
+ 			}
+ 	|	NUMBER LESS_LESS_MINUS WORD
+ 			{
+ 			  source.dest = $1;
+ 			  redir.filename = $3;
+ 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
+-			  redir_stack[need_here_doc++] = $$;
++                          push_redir_stack ($$);
+ 			}
+ 	|	REDIR_WORD  LESS_LESS_MINUS WORD
+ 			{
+ 			  source.filename = $1;
+ 			  redir.filename = $3;
+ 			  $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
+-			  redir_stack[need_here_doc++] = $$;
++                          push_redir_stack ($$);
+ 			}
+ 	|	LESS_LESS_LESS WORD
+ 			{
[email protected]@ -4677,7 +4689,7 @@
+     case CASE:
+     case SELECT:
+     case FOR:
+-      if (word_top < MAX_CASE_NEST)
++      if ((word_top + 1) < MAX_CASE_NEST)
+ 	word_top++;
+       word_lineno[word_top] = line_number;
+       break;