From 71deace00d1a2b091313fe137ab7092418c6f87c Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Mon, 10 Feb 2020 21:05:55 +0000 Subject: gentoo resync : 10.02.2020 --- app-shells/ksh/Manifest | 3 +- app-shells/ksh/files/CVE-2019-14868.patch | 89 +++++++++++++++++++++++++++++++ app-shells/ksh/ksh-2020.0.0-r1.ebuild | 50 +++++++++++++++++ app-shells/ksh/ksh-2020.0.0.ebuild | 49 ----------------- 4 files changed, 141 insertions(+), 50 deletions(-) create mode 100644 app-shells/ksh/files/CVE-2019-14868.patch create mode 100644 app-shells/ksh/ksh-2020.0.0-r1.ebuild delete mode 100644 app-shells/ksh/ksh-2020.0.0.ebuild (limited to 'app-shells/ksh') diff --git a/app-shells/ksh/Manifest b/app-shells/ksh/Manifest index 8b775bc28c1d..69c06c4e0daf 100644 --- a/app-shells/ksh/Manifest +++ b/app-shells/ksh/Manifest @@ -1,6 +1,7 @@ +AUX CVE-2019-14868.patch 3746 BLAKE2B 0be6843120195f876631e92205430f8a389d23c6c9f85b72b4fd7b646551ede464eebaa28db1988a0b831642ab7d3c0e633cdfe28f5279ab29f69aa3bb6bb755 SHA512 ad21464b95ff69b0d8a54f54eee11d638738ba79a87fc5834d409af2d183e5a68e706b3f5df49223dd784e634de353335689981228c7ca57edf94794434d6ea9 AUX ksh-2020.0.0-ensure-user-set.patch 1017 BLAKE2B 8a0d9fd9fd8940969741214f6ba9251ae1b404bae80385d79428ab7231a5809bafcaa5033084af0582872171666e89b590b7c2cfba1ded740da49c77b1751888 SHA512 bea76ef4350d2813395bbfaa682b97a34548292efe9986a1d63dde2476bbfbfd21dc9b10ccb7ac3bcf33e9aeb3c0eebdcffb22a3b6472302597473ac994b2493 AUX ksh-2020.0.0-skip-api-test.patch 1394 BLAKE2B bcf521012bb197d234b119dc56ddc068f8ec3e46b6f4c6d82e1043629368bfcabd1a5d360bae702777e5b01914ac70c9edbdce5ee0bba7e9f69916a3c38b1820 SHA512 e4314599821b3f654b4c87900aa696930953a96b984f43ca00fd17aa91b968ed8f277944c6736ebddae4ee7086e9806f84e3432b24450565d1c679bdbb39e01a DIST ksh-2020.0.0.tar.gz 2022880 BLAKE2B cb952c4febe88a3ccf8fd48f511a30a73bfc812ebf0b7a5fe799470b29ee13ca61004fd34e367d836940a88214da2aa05b7cb96f173a1b8d57c8e644c8c3a2a6 SHA512 7d6da3af341a62718d691ddc52e10bdf3b7290d74f1cd01610093c587af47b6d6d04b74b210eb31f93a3559855a5bc5155f9b188d2f8bb4444042c26bfaf1792 -EBUILD ksh-2020.0.0.ebuild 1087 BLAKE2B d4de3298e870b57abfd03b24e8bd7c40d166749452317ca52fde421634e6ba6ead52b3e736df297b04f8e6575735df0cbf0ff620e473a942abf6c61af51660a9 SHA512 69440a0266c563586fce52171e986b742ff40abcf9089b3a9f3b8307a221f5d0f9d0f5b944ada20216a404d99d86998b9d02045d78af4b61142f863e5ec63d2a +EBUILD ksh-2020.0.0-r1.ebuild 1123 BLAKE2B a1ca7574835877a1354c39ccb6c65c4ae4aba7f7bfdd3c198b641f97174841a46bd6a3dc931808418ff0fa2a93e16d2a9fc11774f1b7d4c24b7f3899a2d6c4ff SHA512 1dc0af0d3469c8a9d106880d7b8e21c6bc48e6629965de6e53880bdca308e63f93bf610775592795c5d5caa844a9083fe8f4ba5fadb03ecb93bb3fb3095a6e0c EBUILD ksh-9999.ebuild 976 BLAKE2B 4807cd3805a2f7f05a726019c707c6fe0106b636f0d221f31dd08b62b249df4815cb4bf6c5b0309863e2916a919c53aabcbe4c8efe3e8218655f2078cbb03361 SHA512 09f6498596ea5cf1c9a49eec1d8572a30b27649b0aa3a1eda99eaff959279627db59fd3a694a5929e8075dc2e641bfa65442a1a4819b9f1af5ca174d91bb5fb5 MISC metadata.xml 1371 BLAKE2B ab655b6d15894748f8125dcc0d25fd15aee57623de8b643793b1ca456025ee35db091b500f91b59ca0801778eb65798162b732778c56b80adff4f0402b299638 SHA512 b74fe4a12ce5868839cd32fe9c4f88c216a0703a3f477b005dcf7b47f697d129c695a011a9b37894c39716b5d47ddc9abeb5bd4946ba6b6849707a73b5901810 diff --git a/app-shells/ksh/files/CVE-2019-14868.patch b/app-shells/ksh/files/CVE-2019-14868.patch new file mode 100644 index 000000000000..d5c80566bafc --- /dev/null +++ b/app-shells/ksh/files/CVE-2019-14868.patch @@ -0,0 +1,89 @@ +From c7de8b641266bac7c77942239ac659edfee9ecd2 Mon Sep 17 00:00:00 2001 +From: Kurtis Rader +Date: Thu, 12 Dec 2019 18:46:50 -0800 +Subject: [PATCH] Harden env var imports + +--- + src/cmd/ksh93/sh/arith.c | 37 ++++++++++++++++++++++----------- + src/cmd/ksh93/tests/subshell.sh | 23 ++++++++++++++++++++ + +diff --git a/src/cmd/ksh93/sh/arith.c b/src/cmd/ksh93/sh/arith.c +index 30b3067590a2..8e68cbdc868a 100644 +--- a/src/cmd/ksh93/sh/arith.c ++++ b/src/cmd/ksh93/sh/arith.c +@@ -567,19 +567,32 @@ Sfdouble_t sh_strnum(Shell_t *shp, const char *str, char **ptr, int mode) { + char *last; + + if (*str == 0) { +- if (ptr) *ptr = (char *)str; +- return 0; +- } +- errno = 0; +- d = number(str, &last, shp->inarith ? 0 : 10, NULL); +- if (*last) { +- if (*last != '.' || last[1] != '.') { +- d = strval(shp, str, &last, arith, mode); +- Varsubscript = true; ++ d = 0.0; ++ last = (char *)str; ++ } else { ++ d = number(str, &last, shp->inarith ? 0 : 10, NULL); ++ if (*last && !shp->inarith && sh_isstate(shp, SH_INIT)) { ++ // This call is to handle "base#value" literals if we're importing untrusted env vars. ++ d = number(str, &last, 0, NULL); ++ } ++ if (*last) { ++ if (sh_isstate(shp, SH_INIT)) { ++ // Initializing means importing untrusted env vars. Since the string does not appear ++ // to be a recognized numeric literal give up. We can't safely call strval() since ++ // that allows arbitrary expressions which would create a security vulnerability. ++ d = 0.0; ++ } else { ++ if (*last != '.' || last[1] != '.') { ++ d = strval(shp, str, &last, arith, mode); ++ Varsubscript = true; ++ } ++ if (!ptr && *last && mode > 0) { ++ errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str); ++ } ++ } ++ } else if (d == 0.0 && *str == '-') { ++ d = -0.0; + } +- if (!ptr && *last && mode > 0) errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str); +- } else if (!d && *str == '-') { +- d = -0.0; + } + if (ptr) *ptr = last; + return d; +diff --git a/src/cmd/ksh93/tests/subshell.sh b/src/cmd/ksh93/tests/subshell.sh +index b63a8051ed5c..3faba475d6de 100644 +--- a/src/cmd/ksh93/tests/subshell.sh ++++ b/src/cmd/ksh93/tests/subshell.sh +@@ -856,3 +856,26 @@ for exp in 65535 65536 + do got=$($SHELL -c 'x=$(printf "%.*c" '$exp' x); print ${#x}' 2>&1) + [[ $got == $exp ]] || log_error "large command substitution failed" "$exp" "$got" + done ++ ++# ========== ++# Verify that importing untrusted env vars does not allow evaluating arbitrary expressions but does ++# recognize all integer literals recognized by ksh. ++expect=8 ++actual=$(env SHLVL='7' $SHELL -c 'echo $SHLVL') ++[[ $actual == $expect ]] || log_error "decimal int literal not recognized" "$expect" "$actual" ++ ++expect=14 ++actual=$(env SHLVL='013' $SHELL -c 'echo $SHLVL') ++[[ $actual == $expect ]] || log_error "leading zeros int literal not recognized" "$expect" "$actual" ++ ++expect=4 ++actual=$(env SHLVL='2#11' $SHELL -c 'echo $SHLVL') ++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual" ++ ++expect=12 ++actual=$(env SHLVL='16#B' $SHELL -c 'echo $SHLVL') ++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual" ++ ++expect=1 ++actual=$(env SHLVL="2#11+x[\$($bin_echo DANGER WILL ROBINSON >&2)0]" $SHELL -c 'echo $SHLVL') ++[[ $actual == $expect ]] || log_error "expression allowed on env var import" "$expect" "$actual" diff --git a/app-shells/ksh/ksh-2020.0.0-r1.ebuild b/app-shells/ksh/ksh-2020.0.0-r1.ebuild new file mode 100644 index 000000000000..3c4891ea637e --- /dev/null +++ b/app-shells/ksh/ksh-2020.0.0-r1.ebuild @@ -0,0 +1,50 @@ +# Copyright 1999-2020 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +inherit meson + +if [[ ${PV} == 9999 ]]; then + inherit git-r3 + EGIT_REPO_URI="https://github.com/att/ast" +else + KEYWORDS="~alpha ~amd64 ~arm ~ia64 ~ppc ~ppc64 ~s390 ~sparc ~x86" + MY_PV="${PV/_/-}" + MY_P="${PN}-${MY_PV}" + SRC_URI="https://github.com/att/ast/releases/download/${MY_PV}/${MY_P}.tar.gz" + S="${WORKDIR}/${MY_P}" +fi + +DESCRIPTION="The Original Korn Shell, 1993 revision (ksh93)" +HOMEPAGE="https://github.com/att/ast" + +LICENSE="CPL-1.0 EPL-1.0" +SLOT="0" + +RDEPEND="!app-shells/pdksh" + +PATCHES=( + "${FILESDIR}"/ksh-2020.0.0-ensure-user-set.patch + "${FILESDIR}"/ksh-2020.0.0-skip-api-test.patch + "${FILESDIR}"/CVE-2019-14868.patch +) + +src_test() { + # https://bugs.gentoo.org/702570 + addwrite /proc/self + local cmd=( + meson test + -C "${BUILD_DIR}" + --num-processes "$(makeopts_jobs ${NINJAOPTS:-${MAKEOPTS}})" + ) + echo "${cmd[@]}" >&2 + # https://github.com/att/ast/issues/1392 + env -u T "${cmd[@]}" || die +} + +src_install() { + meson_src_install + dodir /bin + mv "${ED}/usr/bin/ksh" "${ED}/bin/ksh" || die +} diff --git a/app-shells/ksh/ksh-2020.0.0.ebuild b/app-shells/ksh/ksh-2020.0.0.ebuild deleted file mode 100644 index 6b40cd312997..000000000000 --- a/app-shells/ksh/ksh-2020.0.0.ebuild +++ /dev/null @@ -1,49 +0,0 @@ -# Copyright 1999-2019 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 - -inherit meson - -if [[ ${PV} == 9999 ]]; then - inherit git-r3 - EGIT_REPO_URI="https://github.com/att/ast" -else - KEYWORDS="~alpha ~amd64 ~arm ~ia64 ~ppc ~ppc64 ~s390 ~sparc ~x86" - MY_PV="${PV/_/-}" - MY_P="${PN}-${MY_PV}" - SRC_URI="https://github.com/att/ast/releases/download/${MY_PV}/${MY_P}.tar.gz" - S="${WORKDIR}/${MY_P}" -fi - -DESCRIPTION="The Original Korn Shell, 1993 revision (ksh93)" -HOMEPAGE="https://github.com/att/ast" - -LICENSE="CPL-1.0 EPL-1.0" -SLOT="0" - -RDEPEND="!app-shells/pdksh" - -PATCHES=( - "${FILESDIR}"/ksh-2020.0.0-ensure-user-set.patch - "${FILESDIR}"/ksh-2020.0.0-skip-api-test.patch -) - -src_test() { - # https://bugs.gentoo.org/702570 - addwrite /proc/self - local cmd=( - meson test - -C "${BUILD_DIR}" - --num-processes "$(makeopts_jobs ${NINJAOPTS:-${MAKEOPTS}})" - ) - echo "${cmd[@]}" >&2 - # https://github.com/att/ast/issues/1392 - env -u T "${cmd[@]}" || die -} - -src_install() { - meson_src_install - dodir /bin - mv "${ED}/usr/bin/ksh" "${ED}/bin/ksh" || die -} -- cgit v1.2.3