| 1 | BASH PATCH REPORT |
|---|
| 2 | ================= |
|---|
| 3 | |
|---|
| 4 | Bash-Release: 4.3 |
|---|
| 5 | Patch-ID: bash43-035 |
|---|
| 6 | |
|---|
| 7 | Bug-Reported-by: <romerox.adrian@gmail.com> |
|---|
| 8 | Bug-Reference-ID: <CABV5r3zhPXmSKUe9uedeGc5YFBM2njJ1iVmY2h5neWdQpDBQug@mail.gmail.com> |
|---|
| 9 | Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2014-08/msg00045.html |
|---|
| 10 | |
|---|
| 11 | Bug-Description: |
|---|
| 12 | |
|---|
| 13 | A locale with a long name can trigger a buffer overflow and core dump. This |
|---|
| 14 | applies on systems that do not have locale_charset in libc, are not using |
|---|
| 15 | GNU libiconv, and are not using the libintl that ships with bash in lib/intl. |
|---|
| 16 | |
|---|
| 17 | Patch (apply with `patch -p0'): |
|---|
| 18 | |
|---|
| 19 | *** ../bash-4.3-patched/lib/sh/unicode.c 2014-01-30 16:47:19.000000000 -0500 |
|---|
| 20 | --- lib/sh/unicode.c 2015-05-01 08:58:30.000000000 -0400 |
|---|
| 21 | *************** |
|---|
| 22 | *** 79,83 **** |
|---|
| 23 | if (s) |
|---|
| 24 | { |
|---|
| 25 | ! strcpy (charsetbuf, s+1); |
|---|
| 26 | t = strchr (charsetbuf, '@'); |
|---|
| 27 | if (t) |
|---|
| 28 | --- 79,84 ---- |
|---|
| 29 | if (s) |
|---|
| 30 | { |
|---|
| 31 | ! strncpy (charsetbuf, s+1, sizeof (charsetbuf) - 1); |
|---|
| 32 | ! charsetbuf[sizeof (charsetbuf) - 1] = '\0'; |
|---|
| 33 | t = strchr (charsetbuf, '@'); |
|---|
| 34 | if (t) |
|---|
| 35 | *************** |
|---|
| 36 | *** 85,89 **** |
|---|
| 37 | return charsetbuf; |
|---|
| 38 | } |
|---|
| 39 | ! strcpy (charsetbuf, locale); |
|---|
| 40 | return charsetbuf; |
|---|
| 41 | } |
|---|
| 42 | --- 86,91 ---- |
|---|
| 43 | return charsetbuf; |
|---|
| 44 | } |
|---|
| 45 | ! strncpy (charsetbuf, locale, sizeof (charsetbuf) - 1); |
|---|
| 46 | ! charsetbuf[sizeof (charsetbuf) - 1] = '\0'; |
|---|
| 47 | return charsetbuf; |
|---|
| 48 | } |
|---|
| 49 | *** ../bash-4.3/patchlevel.h 2012-12-29 10:47:57.000000000 -0500 |
|---|
| 50 | --- patchlevel.h 2014-03-20 20:01:28.000000000 -0400 |
|---|
| 51 | *************** |
|---|
| 52 | *** 26,30 **** |
|---|
| 53 | looks for to find the patch level (for the sccs version string). */ |
|---|
| 54 | |
|---|
| 55 | ! #define PATCHLEVEL 34 |
|---|
| 56 | |
|---|
| 57 | #endif /* _PATCHLEVEL_H_ */ |
|---|
| 58 | --- 26,30 ---- |
|---|
| 59 | looks for to find the patch level (for the sccs version string). */ |
|---|
| 60 | |
|---|
| 61 | ! #define PATCHLEVEL 35 |
|---|
| 62 | |
|---|
| 63 | #endif /* _PATCHLEVEL_H_ */ |
|---|
