Attachment 942671 Details for Bug 1147043 – at-skip-names.diff

[patch] at-skip-names.diff

at-skip-names.diff (text/plain), 1.18 KB, created by Florian Weimer on 2014-09-30 11:42:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Florian Weimer

Created: 2014-09-30 11:42:20 UTC

Size: 1.18 KB

patch

obsolete

>commit 482f5962d9584d6110b940f0f51ab5919a6eb8a0
>Author: Ansgar Burchardt <ansgar@debian.org>
>Date:   Sun Sep 28 17:06:12 2014 +0200
>
>    at: only retain variables whose name consists of alphanumerics and underscores
>    
>    Since a recent security update[1] bash might export variables named
>    BASH_FUNC_*() to the environment which the serialization code in at
>    cannot handle properly.
>    
>      [1] <https://www.debian.org/security/2014/dsa-3035>
>
>diff --git a/at.c b/at.c
>index 72ed533..5f5038d 100644
>--- a/at.c
>+++ b/at.c
>@@ -390,6 +390,22 @@ writefile(time_t runtimer, char queue)
> 	int export = 1;
> 	char *eqp;
> 
>+        /* Only accept alphanumerics and underscore in variable names.
>+         * Also require the name to not start with a digit.
>+         * Some shells don't like other variable names.
>+         */
>+        {
>+            char *p = *atenv;
>+            if (isdigit(*p))
>+                export = 0;
>+            for (; *p != '=' && *p != '\0'; ++p) {
>+                if (!isalnum(*p) && *p != '_') {
>+                    export = 0;
>+                    break;
>+                }
>+            }
>+        }
>+
> 	eqp = strchr(*atenv, '=');
> 	if (ap == NULL)
> 	    eqp = *atenv;

Actions: View | Diff

Attachments on bug 1147043: 942671