app-shells/ksh: add fix for CVE-2019-14868

Bug: https://bugs.gentoo.org/708618
Package-Manager: Portage-2.3.86_p1, Repoman-2.3.20_p43
Signed-off-by: Mike Gilbert <floppym@gentoo.org>

2 files changed, 91 insertions, 1 deletions

diff --git a/app-shells/ksh/files/CVE-2019-14868.patch b/app-shells/ksh/files/CVE-2019-14868.patch
new file mode 100644
index 000000000000..d5c80566bafc
--- /dev/null
+++ b/app-shells/ksh/files/CVE-2019-14868.patch
@@ -0,0 +1,89 @@
+From c7de8b641266bac7c77942239ac659edfee9ecd2 Mon Sep 17 00:00:00 2001
+From: Kurtis Rader <krader@skepticism.us>
+Date: Thu, 12 Dec 2019 18:46:50 -0800
+Subject: [PATCH] Harden env var imports
+
+---
+ src/cmd/ksh93/sh/arith.c        | 37 ++++++++++++++++++++++-----------
+ src/cmd/ksh93/tests/subshell.sh | 23 ++++++++++++++++++++
+
+diff --git a/src/cmd/ksh93/sh/arith.c b/src/cmd/ksh93/sh/arith.c
+index 30b3067590a2..8e68cbdc868a 100644
+--- a/src/cmd/ksh93/sh/arith.c
++++ b/src/cmd/ksh93/sh/arith.c
+@@ -567,19 +567,32 @@ Sfdouble_t sh_strnum(Shell_t *shp, const char *str, char **ptr, int mode) {
+     char *last;
+ 
+     if (*str == 0) {
+-        if (ptr) *ptr = (char *)str;
+-        return 0;
+-    }
+-    errno = 0;
+-    d = number(str, &last, shp->inarith ? 0 : 10, NULL);
+-    if (*last) {
+-        if (*last != '.' || last[1] != '.') {
+-            d = strval(shp, str, &last, arith, mode);
+-            Varsubscript = true;
++        d = 0.0;
++        last = (char *)str;
++    } else {
++        d = number(str, &last, shp->inarith ? 0 : 10, NULL);
++        if (*last && !shp->inarith && sh_isstate(shp, SH_INIT)) {
++            // This call is to handle "base#value" literals if we're importing untrusted env vars.
++            d = number(str, &last, 0, NULL);
++        }
++        if (*last) {
++            if (sh_isstate(shp, SH_INIT)) {
++                // Initializing means importing untrusted env vars. Since the string does not appear
++                // to be a recognized numeric literal give up. We can't safely call strval() since
++                // that allows arbitrary expressions which would create a security vulnerability.
++                d = 0.0;
++            } else {
++                if (*last != '.' || last[1] != '.') {
++                    d = strval(shp, str, &last, arith, mode);
++                    Varsubscript = true;
++                }
++                if (!ptr && *last && mode > 0) {
++                    errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str);
++                }
++            }
++        } else if (d == 0.0 && *str == '-') {
++            d = -0.0;
+         }
+-        if (!ptr && *last && mode > 0) errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str);
+-    } else if (!d && *str == '-') {
+-        d = -0.0;
+     }
+     if (ptr) *ptr = last;
+     return d;
+diff --git a/src/cmd/ksh93/tests/subshell.sh b/src/cmd/ksh93/tests/subshell.sh
+index b63a8051ed5c..3faba475d6de 100644
+--- a/src/cmd/ksh93/tests/subshell.sh
++++ b/src/cmd/ksh93/tests/subshell.sh
+@@ -856,3 +856,26 @@ for exp in 65535 65536
+ do    got=$($SHELL -c 'x=$(printf "%.*c" '$exp' x); print ${#x}' 2>&1)
+     [[ $got == $exp ]] || log_error "large command substitution failed" "$exp" "$got"
+ done
++
++# ==========
++# Verify that importing untrusted env vars does not allow evaluating arbitrary expressions but does
++# recognize all integer literals recognized by ksh.
++expect=8
++actual=$(env SHLVL='7' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "decimal int literal not recognized" "$expect" "$actual"
++
++expect=14
++actual=$(env SHLVL='013' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "leading zeros int literal not recognized" "$expect" "$actual"
++
++expect=4
++actual=$(env SHLVL='2#11' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual"
++
++expect=12
++actual=$(env SHLVL='16#B' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual"
++
++expect=1
++actual=$(env SHLVL="2#11+x[\$($bin_echo DANGER WILL ROBINSON >&2)0]" $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "expression allowed on env var import" "$expect" "$actual"
diff --git a/app-shells/ksh/ksh-2020.0.0.ebuild b/app-shells/ksh/ksh-2020.0.0-r1.ebuild
index 6b40cd312997..3c4891ea637e 100644
--- a/app-shells/ksh/ksh-2020.0.0.ebuild
+++ b/app-shells/ksh/ksh-2020.0.0-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -27,6 +27,7 @@ RDEPEND="!app-shells/pdksh"
 PATCHES=(
 	"${FILESDIR}"/ksh-2020.0.0-ensure-user-set.patch
 	"${FILESDIR}"/ksh-2020.0.0-skip-api-test.patch
+	"${FILESDIR}"/CVE-2019-14868.patch
 )
 
 src_test() {