BASH PATCH REPORT ================= Bash-Release: 2.05b Patch-ID: bash205b-013 Bug-Reported-by: Michal Zalewski Bug-Reference-ID: Bug-Reference-URL: Bug-Description: A combination of nested command substitutions and function importing from the environment can cause bash to execute code appearing in the environment variable value following the function definition. Patch: *** ../bash-2.05b.12/builtins/evalstring.c 2014-09-25 10:18:20.000000000 -0400 --- builtins/evalstring.c 2014-10-04 16:33:35.000000000 -0400 *************** *** 205,214 **** struct fd_bitmap *bitmap; ! if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) { ! internal_warning ("%s: ignoring function definition attempt", from_file); ! should_jump_to_top_level = 0; ! last_result = last_command_exit_value = EX_BADUSAGE; ! break; } --- 205,227 ---- struct fd_bitmap *bitmap; ! if (flags & SEVAL_FUNCDEF) { ! char *x; ! ! /* If the command parses to something other than a straight ! function definition, or if we have not consumed the entire ! string, or if the parser has transformed the function ! name (as parsing will if it begins or ends with shell ! whitespace, for example), reject the attempt */ ! if (command->type != cm_function_def || ! ((x = parser_remaining_input ()) && *x) || ! (STREQ (from_file, command->value.Function_def->name->word) == 0)) ! { ! internal_warning ("%s: ignoring function definition attempt", from_file); ! should_jump_to_top_level = 0; ! last_result = last_command_exit_value = EX_BADUSAGE; ! reset_parser (); ! break; ! } } *************** *** 266,270 **** if (flags & SEVAL_ONECMD) ! break; } } --- 279,286 ---- if (flags & SEVAL_ONECMD) ! { ! reset_parser (); ! break; ! } } } *** ../bash-2.05b.12/parse.y 2014-09-30 20:11:38.000000000 -0400 --- parse.y 2014-10-04 16:28:49.000000000 -0400 *************** *** 1993,1996 **** --- 1993,2006 ---- } + char * + parser_remaining_input () + { + if (shell_input_line == 0) + return 0; + if (shell_input_line_index < 0 || shell_input_line_index >= shell_input_line_len) + return '\0'; /* XXX */ + return (shell_input_line + shell_input_line_index); + } + #ifdef INCLUDE_UNUSED /* Back the input pointer up by one, effectively `ungetting' a character. */ *** ../bash-2.05b.12/shell.h 2002-03-07 16:59:10.000000000 -0500 --- shell.h 2014-10-04 16:28:49.000000000 -0400 *************** *** 120,121 **** --- 120,123 ---- # define USE_VAR(x) #endif + extern char *parser_remaining_input __P((void)); +