bash44-003.patch 1.7 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162
  1. From https://ftp.gnu.org/gnu/bash/bash-4.4-patches/bash44-003
  2. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
  3. BASH PATCH REPORT
  4. =================
  5. Bash-Release: 4.4
  6. Patch-ID: bash44-003
  7. Bug-Reported-by: op7ic \x00 <op7ica@gmail.com>
  8. Bug-Reference-ID: <CAFHyJTopWC5Jx+U7WcvxSZKu+KrqSf+_3sHPiRWo=VzXSiPq=w@mail.gmail.com>
  9. Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2016-11/msg00005.html
  10. Bug-Description:
  11. Specially-crafted input, in this case an incomplete pathname expansion
  12. bracket expression containing an invalid collating symbol, can cause the
  13. shell to crash.
  14. Patch (apply with `patch -p0'):
  15. *** a/bash-4.4/lib/glob/sm_loop.c 2016-04-10 11:23:21.000000000 -0400
  16. --- b/lib/glob/sm_loop.c 2016-11-02 14:03:34.000000000 -0400
  17. ***************
  18. *** 331,334 ****
  19. --- 331,340 ----
  20. if (p[pc] == L('.') && p[pc+1] == L(']'))
  21. break;
  22. + if (p[pc] == 0)
  23. + {
  24. + if (vp)
  25. + *vp = INVALID;
  26. + return (p + pc);
  27. + }
  28. val = COLLSYM (p, pc);
  29. if (vp)
  30. ***************
  31. *** 484,487 ****
  32. --- 490,496 ----
  33. c = FOLD (c);
  34. + if (c == L('\0'))
  35. + return ((test == L('[')) ? savep : (CHAR *)0);
  36. +
  37. if ((flags & FNM_PATHNAME) && c == L('/'))
  38. /* [/] can never match when matching a pathname. */
  39. *** a/bash-4.4/patchlevel.h 2016-06-22 14:51:03.000000000 -0400
  40. --- b/patchlevel.h 2016-10-01 11:01:28.000000000 -0400
  41. ***************
  42. *** 26,30 ****
  43. looks for to find the patch level (for the sccs version string). */
  44. ! #define PATCHLEVEL 2
  45. #endif /* _PATCHLEVEL_H_ */
  46. --- 26,30 ----
  47. looks for to find the patch level (for the sccs version string). */
  48. ! #define PATCHLEVEL 3
  49. #endif /* _PATCHLEVEL_H_ */