summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMike Gilbert <floppym@gentoo.org>2020-02-07 11:07:03 -0500
committerMike Gilbert <floppym@gentoo.org>2020-02-07 11:07:24 -0500
commit17c85a06ac2f352567348a04c4f682c950105417 (patch)
tree89ab9292bfdbf69cfefce3530f08580210c28cd7
parentapp-text/discount: fix build of libmarkdown (diff)
downloadgentoo-17c85a06ac2f352567348a04c4f682c950105417.tar.gz
gentoo-17c85a06ac2f352567348a04c4f682c950105417.tar.bz2
gentoo-17c85a06ac2f352567348a04c4f682c950105417.zip
app-shells/ksh: add fix for CVE-2019-14868
Bug: https://bugs.gentoo.org/708618 Package-Manager: Portage-2.3.86_p1, Repoman-2.3.20_p43 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
-rw-r--r--app-shells/ksh/files/CVE-2019-14868.patch89
-rw-r--r--app-shells/ksh/ksh-2020.0.0-r1.ebuild (renamed from app-shells/ksh/ksh-2020.0.0.ebuild)3
2 files changed, 91 insertions, 1 deletions
diff --git a/app-shells/ksh/files/CVE-2019-14868.patch b/app-shells/ksh/files/CVE-2019-14868.patch
new file mode 100644
index 00000000000..d5c80566baf
--- /dev/null
+++ b/app-shells/ksh/files/CVE-2019-14868.patch
@@ -0,0 +1,89 @@
+From c7de8b641266bac7c77942239ac659edfee9ecd2 Mon Sep 17 00:00:00 2001
+From: Kurtis Rader <krader@skepticism.us>
+Date: Thu, 12 Dec 2019 18:46:50 -0800
+Subject: [PATCH] Harden env var imports
+
+---
+ src/cmd/ksh93/sh/arith.c | 37 ++++++++++++++++++++++-----------
+ src/cmd/ksh93/tests/subshell.sh | 23 ++++++++++++++++++++
+
+diff --git a/src/cmd/ksh93/sh/arith.c b/src/cmd/ksh93/sh/arith.c
+index 30b3067590a2..8e68cbdc868a 100644
+--- a/src/cmd/ksh93/sh/arith.c
++++ b/src/cmd/ksh93/sh/arith.c
+@@ -567,19 +567,32 @@ Sfdouble_t sh_strnum(Shell_t *shp, const char *str, char **ptr, int mode) {
+ char *last;
+
+ if (*str == 0) {
+- if (ptr) *ptr = (char *)str;
+- return 0;
+- }
+- errno = 0;
+- d = number(str, &last, shp->inarith ? 0 : 10, NULL);
+- if (*last) {
+- if (*last != '.' || last[1] != '.') {
+- d = strval(shp, str, &last, arith, mode);
+- Varsubscript = true;
++ d = 0.0;
++ last = (char *)str;
++ } else {
++ d = number(str, &last, shp->inarith ? 0 : 10, NULL);
++ if (*last && !shp->inarith && sh_isstate(shp, SH_INIT)) {
++ // This call is to handle "base#value" literals if we're importing untrusted env vars.
++ d = number(str, &last, 0, NULL);
++ }
++ if (*last) {
++ if (sh_isstate(shp, SH_INIT)) {
++ // Initializing means importing untrusted env vars. Since the string does not appear
++ // to be a recognized numeric literal give up. We can't safely call strval() since
++ // that allows arbitrary expressions which would create a security vulnerability.
++ d = 0.0;
++ } else {
++ if (*last != '.' || last[1] != '.') {
++ d = strval(shp, str, &last, arith, mode);
++ Varsubscript = true;
++ }
++ if (!ptr && *last && mode > 0) {
++ errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str);
++ }
++ }
++ } else if (d == 0.0 && *str == '-') {
++ d = -0.0;
+ }
+- if (!ptr && *last && mode > 0) errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str);
+- } else if (!d && *str == '-') {
+- d = -0.0;
+ }
+ if (ptr) *ptr = last;
+ return d;
+diff --git a/src/cmd/ksh93/tests/subshell.sh b/src/cmd/ksh93/tests/subshell.sh
+index b63a8051ed5c..3faba475d6de 100644
+--- a/src/cmd/ksh93/tests/subshell.sh
++++ b/src/cmd/ksh93/tests/subshell.sh
+@@ -856,3 +856,26 @@ for exp in 65535 65536
+ do got=$($SHELL -c 'x=$(printf "%.*c" '$exp' x); print ${#x}' 2>&1)
+ [[ $got == $exp ]] || log_error "large command substitution failed" "$exp" "$got"
+ done
++
++# ==========
++# Verify that importing untrusted env vars does not allow evaluating arbitrary expressions but does
++# recognize all integer literals recognized by ksh.
++expect=8
++actual=$(env SHLVL='7' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "decimal int literal not recognized" "$expect" "$actual"
++
++expect=14
++actual=$(env SHLVL='013' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "leading zeros int literal not recognized" "$expect" "$actual"
++
++expect=4
++actual=$(env SHLVL='2#11' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual"
++
++expect=12
++actual=$(env SHLVL='16#B' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual"
++
++expect=1
++actual=$(env SHLVL="2#11+x[\$($bin_echo DANGER WILL ROBINSON >&2)0]" $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "expression allowed on env var import" "$expect" "$actual"
diff --git a/app-shells/ksh/ksh-2020.0.0.ebuild b/app-shells/ksh/ksh-2020.0.0-r1.ebuild
index 6b40cd31299..3c4891ea637 100644
--- a/app-shells/ksh/ksh-2020.0.0.ebuild
+++ b/app-shells/ksh/ksh-2020.0.0-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
@@ -27,6 +27,7 @@ RDEPEND="!app-shells/pdksh"
PATCHES=(
"${FILESDIR}"/ksh-2020.0.0-ensure-user-set.patch
"${FILESDIR}"/ksh-2020.0.0-skip-api-test.patch
+ "${FILESDIR}"/CVE-2019-14868.patch
)
src_test() {