Attachment 942613 Details for Bug 1146791 – Patch for CVE-2014-7186 and CVE-2014-7187

[patch] Patch for CVE-2014-7186 and CVE-2014-7187

bash-4.2-cve-2014-7169-2.patch (text/plain), 2.50 KB, created by Tomas Hoger on 2014-09-30 07:06:51 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2014-09-30 07:06:51 UTC

Size: 2.50 KB

patch

obsolete

>--- ../bash-4.2-orig/parse.y	2014-09-25 13:07:59.218209276 +0200
>+++ parse.y	2014-09-25 15:26:52.813159810 +0200
>@@ -264,9 +264,21 @@
> 
> /* Variables to manage the task of reading here documents, because we need to
>    defer the reading until after a complete command has been collected. */
>-static REDIRECT *redir_stack[10];
>+static REDIRECT **redir_stack;
> int need_here_doc;
> 
>+/* Pushes REDIR onto redir_stack, resizing it as needed. */
>+static void
>+push_redir_stack (REDIRECT *redir)
>+{
>+  /* Guard against oveflow. */
>+  if (need_here_doc + 1 > INT_MAX / sizeof (*redir_stack))
>+    abort ();
>+  redir_stack = xrealloc (redir_stack,
>+			  (need_here_doc + 1) * sizeof (*redir_stack));
>+  redir_stack[need_here_doc++] = redir;
>+}
>+
> /* Where shell input comes from.  History expansion is performed on each
>    line when the shell is interactive. */
> static char *shell_input_line = (char *)NULL;
>@@ -519,42 +531,42 @@
> 			  source.dest = 0;
> 			  redir.filename = $2;
> 			  $$ = make_redirection (source, r_reading_until, redir, 0);
>-			  redir_stack[need_here_doc++] = $$;
>+			  push_redir_stack ($$);
> 			}
> 	|	NUMBER LESS_LESS WORD
> 			{
> 			  source.dest = $1;
> 			  redir.filename = $3;
> 			  $$ = make_redirection (source, r_reading_until, redir, 0);
>-			  redir_stack[need_here_doc++] = $$;
>+			  push_redir_stack ($$);
> 			}
> 	|	REDIR_WORD LESS_LESS WORD
> 			{
> 			  source.filename = $1;
> 			  redir.filename = $3;
> 			  $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
>-			  redir_stack[need_here_doc++] = $$;
>+			  push_redir_stack ($$);
> 			}
> 	|	LESS_LESS_MINUS WORD
> 			{
> 			  source.dest = 0;
> 			  redir.filename = $2;
> 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
>-			  redir_stack[need_here_doc++] = $$;
>+			  push_redir_stack ($$);
> 			}
> 	|	NUMBER LESS_LESS_MINUS WORD
> 			{
> 			  source.dest = $1;
> 			  redir.filename = $3;
> 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
>-			  redir_stack[need_here_doc++] = $$;
>+			  push_redir_stack ($$);
> 			}
> 	|	REDIR_WORD  LESS_LESS_MINUS WORD
> 			{
> 			  source.filename = $1;
> 			  redir.filename = $3;
> 			  $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
>-			  redir_stack[need_here_doc++] = $$;
>+			  push_redir_stack ($$);
> 			}
> 	|	LESS_LESS_LESS WORD
> 			{
>@@ -4757,7 +4769,7 @@
>     case CASE:
>     case SELECT:
>     case FOR:
>-      if (word_top < MAX_CASE_NEST)
>+      if (word_top + 1 < MAX_CASE_NEST)
> 	word_top++;
>       word_lineno[word_top] = line_number;
>       break;

Actions: View | Diff

Attachments on bug 1146791: 942613