Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 1 Oct 2014 03:35:41 +0000 (UTC)
From:      Bryan Drewery <bdrewery@FreeBSD.org>
To:        ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org
Subject:   svn commit: r369685 - in branches/2014Q3/shells/bash: . files
Message-ID:  <201410010335.s913ZfCv006837@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: bdrewery
Date: Wed Oct  1 03:35:40 2014
New Revision: 369685
URL: http://svnweb.freebsd.org/changeset/ports/369685
QAT: https://qat.redports.org/buildarchive/r369685/

Log:
  MFH: r369684
  
  Add RedHat's patch for CVE-2014-7186, commonly known as "redir_stack" overflow,
  which has not been shown to be as critical as "shellshock" currently.
  
  Security:	CVE-2014-7186

Added:
  branches/2014Q3/shells/bash/files/patch-parse.y
     - copied unchanged from r369684, head/shells/bash/files/patch-parse.y
Modified:
  branches/2014Q3/shells/bash/Makefile
Directory Properties:
  branches/2014Q3/   (props changed)

Modified: branches/2014Q3/shells/bash/Makefile
==============================================================================
--- branches/2014Q3/shells/bash/Makefile	Wed Oct  1 03:35:12 2014	(r369684)
+++ branches/2014Q3/shells/bash/Makefile	Wed Oct  1 03:35:40 2014	(r369685)
@@ -4,7 +4,7 @@
 PORTNAME=		bash
 PATCHLEVEL=		27
 PORTVERSION=		4.3.${PATCHLEVEL:S/^0//g}
-PORTREVISION?=		0
+PORTREVISION?=		1
 CATEGORIES=		shells
 MASTER_SITES=		GNU
 MASTER_SITE_SUBDIR=	${PORTNAME}

Copied: branches/2014Q3/shells/bash/files/patch-parse.y (from r369684, head/shells/bash/files/patch-parse.y)
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ branches/2014Q3/shells/bash/files/patch-parse.y	Wed Oct  1 03:35:40 2014	(r369685, copy of r369684, head/shells/bash/files/patch-parse.y)
@@ -0,0 +1,86 @@
+From Florian Weimer at RedHat for CVE-2014-7186:
+http://www.openwall.com/lists/oss-security/2014/09/25/32
+
+--- parse.y.orig	2014-09-30 12:58:08.462512373 -0400
++++ parse.y	2014-09-30 12:58:08.629018000 -0400
+@@ -265,9 +265,21 @@
+ 
+ /* Variables to manage the task of reading here documents, because we need to
+    defer the reading until after a complete command has been collected. */
+-static REDIRECT *redir_stack[10];
++static REDIRECT **redir_stack;
+ int need_here_doc;
+ 
++/* Pushes REDIR onto redir_stack, resizing it as needed. */
++static void
++push_redir_stack (REDIRECT *redir)
++{
++  /* Guard against oveflow. */
++  if (need_here_doc + 1 > INT_MAX / sizeof (*redir_stack))
++    abort ();
++  redir_stack = xrealloc (redir_stack,
++			  (need_here_doc + 1) * sizeof (*redir_stack));
++  redir_stack[need_here_doc++] = redir;
++}
++
+ /* Where shell input comes from.  History expansion is performed on each
+    line when the shell is interactive. */
+ static char *shell_input_line = (char *)NULL;
+@@ -520,42 +532,42 @@
+ 			  source.dest = 0;
+ 			  redir.filename = $2;
+ 			  $$ = make_redirection (source, r_reading_until, redir, 0);
+-			  redir_stack[need_here_doc++] = $$;
++			  push_redir_stack ($$);
+ 			}
+ 	|	NUMBER LESS_LESS WORD
+ 			{
+ 			  source.dest = $1;
+ 			  redir.filename = $3;
+ 			  $$ = make_redirection (source, r_reading_until, redir, 0);
+-			  redir_stack[need_here_doc++] = $$;
++			  push_redir_stack ($$);
+ 			}
+ 	|	REDIR_WORD LESS_LESS WORD
+ 			{
+ 			  source.filename = $1;
+ 			  redir.filename = $3;
+ 			  $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
+-			  redir_stack[need_here_doc++] = $$;
++			  push_redir_stack ($$);
+ 			}
+ 	|	LESS_LESS_MINUS WORD
+ 			{
+ 			  source.dest = 0;
+ 			  redir.filename = $2;
+ 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
+-			  redir_stack[need_here_doc++] = $$;
++			  push_redir_stack ($$);
+ 			}
+ 	|	NUMBER LESS_LESS_MINUS WORD
+ 			{
+ 			  source.dest = $1;
+ 			  redir.filename = $3;
+ 			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
+-			  redir_stack[need_here_doc++] = $$;
++			  push_redir_stack ($$);
+ 			}
+ 	|	REDIR_WORD  LESS_LESS_MINUS WORD
+ 			{
+ 			  source.filename = $1;
+ 			  redir.filename = $3;
+ 			  $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
+-			  redir_stack[need_here_doc++] = $$;
++			  push_redir_stack ($$);
+ 			}
+ 	|	LESS_LESS_LESS WORD
+ 			{
+@@ -4905,7 +4917,7 @@
+     case CASE:
+     case SELECT:
+     case FOR:
+-      if (word_top < MAX_CASE_NEST)
++      if (word_top + 1 < MAX_CASE_NEST)
+ 	word_top++;
+       word_lineno[word_top] = line_number;
+       break;



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201410010335.s913ZfCv006837>