bash44-004.patch 2.4 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788
  1. From https://ftp.gnu.org/gnu/bash/bash-4.4-patches/bash44-004
  2. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
  3. BASH PATCH REPORT
  4. =================
  5. Bash-Release: 4.4
  6. Patch-ID: bash44-004
  7. Bug-Reported-by: Christian Weisgerber <naddy@mips.inka.de>
  8. Bug-Reference-ID: <20161101160302.GB54856@lorvorc.mips.inka.de>
  9. Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2016-11/msg00004.html
  10. Bug-Description:
  11. There is a race condition that can result in bash referencing freed memory
  12. when freeing data associated with the last process substitution.
  13. Patch (apply with `patch -p0'):
  14. *** a/bash-4.4/jobs.c 2016-08-23 16:38:44.000000000 -0400
  15. --- b/jobs.c 2016-11-02 18:24:45.000000000 -0400
  16. ***************
  17. *** 454,457 ****
  18. --- 454,472 ----
  19. }
  20. + void
  21. + discard_last_procsub_child ()
  22. + {
  23. + PROCESS *disposer;
  24. + sigset_t set, oset;
  25. +
  26. + BLOCK_CHILD (set, oset);
  27. + disposer = last_procsub_child;
  28. + last_procsub_child = (PROCESS *)NULL;
  29. + UNBLOCK_CHILD (oset);
  30. +
  31. + if (disposer)
  32. + discard_pipeline (disposer);
  33. + }
  34. +
  35. struct pipeline_saver *
  36. alloc_pipeline_saver ()
  37. *** a/bash-4.4/jobs.h 2016-04-27 10:35:51.000000000 -0400
  38. --- b/jobs.h 2016-11-02 18:25:08.000000000 -0400
  39. ***************
  40. *** 191,194 ****
  41. --- 191,195 ----
  42. extern void stop_making_children __P((void));
  43. extern void cleanup_the_pipeline __P((void));
  44. + extern void discard_last_procsub_child __P((void));
  45. extern void save_pipeline __P((int));
  46. extern PROCESS *restore_pipeline __P((int));
  47. *** a/bash-4.4/subst.c 2016-08-30 16:46:38.000000000 -0400
  48. --- b/subst.c 2016-11-02 18:23:24.000000000 -0400
  49. ***************
  50. *** 5809,5816 ****
  51. #if defined (JOB_CONTROL)
  52. if (last_procsub_child)
  53. ! {
  54. ! discard_pipeline (last_procsub_child);
  55. ! last_procsub_child = (PROCESS *)NULL;
  56. ! }
  57. last_procsub_child = restore_pipeline (0);
  58. #endif
  59. --- 5834,5838 ----
  60. #if defined (JOB_CONTROL)
  61. if (last_procsub_child)
  62. ! discard_last_procsub_child ();
  63. last_procsub_child = restore_pipeline (0);
  64. #endif
  65. *** a/bash-4.4/patchlevel.h 2016-06-22 14:51:03.000000000 -0400
  66. --- b/patchlevel.h 2016-10-01 11:01:28.000000000 -0400
  67. ***************
  68. *** 26,30 ****
  69. looks for to find the patch level (for the sccs version string). */
  70. ! #define PATCHLEVEL 3
  71. #endif /* _PATCHLEVEL_H_ */
  72. --- 26,30 ----
  73. looks for to find the patch level (for the sccs version string). */
  74. ! #define PATCHLEVEL 4
  75. #endif /* _PATCHLEVEL_H_ */