busybox/backport-CVE-2021-42375.patch
xiechengliang 378a45e767 fix CVE-2021-42373 CVE-2021-42375 and CVE-2021-42376
Signed-off-by: xiechengliang <xiechengliang1@huawei.com>
2021-11-24 19:38:20 +08:00

54 lines
1.4 KiB
Diff

From 9ac1dd9017b2b4acba4734f6f989b88da2ad7616 Mon Sep 17 00:00:00 2001
From: xiechengliang <xiechengliang1@huawei.com>
Date: Wed, 24 Nov 2021 19:15:25 +0800
Subject: [PATCH 2/2] ash: parser: Fix VSLENGTH parsing with trailing garbage
Let's adopt Herbert Xu's patch, not waiting for it to reach dash git:
hush already has a similar fix.
backport from upstream:
https://git.busybox.net/busybox/commit/?id=53a7a9cd8c15d64fcc2278cf8981ba526dfbe0d2
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---
shell/ash.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/shell/ash.c b/shell/ash.c
index a33ab0626..1ca45f9c1 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -12635,7 +12635,7 @@ parsesub: {
do {
STPUTC(c, out);
c = pgetc_eatbnl();
- } while (!subtype && isdigit(c));
+ } while ((subtype == 0 || subtype == VSLENGTH) && isdigit(c));
} else if (c != '}') {
/* $[{[#]]<specialchar>[}] */
int cc = c;
@@ -12665,11 +12665,6 @@ parsesub: {
} else
goto badsub;
- if (c != '}' && subtype == VSLENGTH) {
- /* ${#VAR didn't end with } */
- goto badsub;
- }
-
if (subtype == 0) {
static const char types[] ALIGN1 = "}-+?=";
/* ${VAR...} but not $VAR or ${#VAR} */
@@ -12726,6 +12721,8 @@ parsesub: {
#endif
}
} else {
+ if (subtype == VSLENGTH && c != '}')
+ subtype = 0;
badsub:
pungetc();
}
--
2.27.0