fix CVE-2022-45939

2022-12-01 09:15:33 +00:00 · 2022-12-01 09:15:33 +00:00 · bbc36fb464
commit bbc36fb464
parent ed5c40cadc
2 changed files with 277 additions and 1 deletions
--- a/backport-CVE-2022-45939.patch
+++ b/backport-CVE-2022-45939.patch
@ -0,0 +1,272 @@
+From d48bb4874bc6cd3e69c7a15fc3c91cc141025c51 Mon Sep 17 00:00:00 2001
+From: lu4nx <lx@shellcodes.org>
+Date: Fri, 25 Nov 2022 14:38:29 +0800
+Subject: Fixed ctags local command execute vulnerability
+
+* lib-src/etags.c:
+
+(clean_matched_file_tag): New function
+(do_move_file): New function
+(readline_internal):
+Add `leave_cr` parameter, if true, include the \r character
+
+* test/manual/etags/CTAGS.good_crlf: New file
+* test/manual/etags/CTAGS.good_update: New file
+* test/manual/etags/crlf: New file
+* test/manual/etags/Makefile: Add `ctags -u` test cases
+
+Conflict:Removed test case related code, so the patch is over 9000 lines, it's too big
+Reference:https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=d48bb4874bc6cd3e69c7a15fc3c91cc141025c51
+---
+ lib-src/etags.c                     |  149 +-
+ 1 files changed, 113 insertions(+), 36 deletions(-)
+
+diff --git a/lib-src/etags.c b/lib-src/etags.c
+index 3107c7b..b6f51df 100644
+--- a/lib-src/etags.c
+++ b/lib-src/etags.c
+@@ -375,7 +375,7 @@ static void just_read_file (FILE *);
+ 
+ static language *get_language_from_langname (const char *);
+ static void readline (linebuffer *, FILE *);
+-static ptrdiff_t readline_internal (linebuffer *, FILE *, char const *);
+static ptrdiff_t readline_internal (linebuffer *, FILE *, char const *, const bool);
+ static bool nocase_tail (const char *);
+ static void get_tag (char *, char **);
+ static void get_lispy_tag (char *);
+@@ -399,7 +399,9 @@ static void free_fdesc (fdesc *);
+ static void pfnote (char *, bool, char *, ptrdiff_t, intmax_t, intmax_t);
+ static void invalidate_nodes (fdesc *, node **);
+ static void put_entries (node *);
+static void clean_matched_file_tag (char const * const, char const * const);
+ 
+static void do_move_file (const char *, const char *);
+ static char *concat (const char *, const char *, const char *);
+ static char *skip_spaces (char *);
+ static char *skip_non_spaces (char *);
+@@ -1332,7 +1334,7 @@ main (int argc, char **argv)
+ 		  if (parsing_stdin)
+ 		    fatal ("cannot parse standard input "
+ 			   "AND read file names from it");
+-		  while (readline_internal (&filename_lb, stdin, "-") > 0)
+		  while (readline_internal (&filename_lb, stdin, "-", false) > 0)
+ 		    process_file_name (filename_lb.buffer, lang);
+ 		}
+ 	      else
+@@ -1380,9 +1382,6 @@ main (int argc, char **argv)
+   /* From here on, we are in (CTAGS && !cxref_style) */
+   if (update)
+     {
+-      char *cmd =
+-	xmalloc (strlen (tagfile) + whatlen_max +
+-		 sizeof "mv..OTAGS;grep -Fv '\t\t' OTAGS >;rm OTAGS");
+       for (i = 0; i < current_arg; ++i)
+ 	{
+ 	  switch (argbuffer[i].arg_type)
+@@ -1393,17 +1392,8 @@ main (int argc, char **argv)
+ 	    default:
+ 	      continue;		/* the for loop */
+ 	    }
+-	  char *z = stpcpy (cmd, "mv ");
+-	  z = stpcpy (z, tagfile);
+-	  z = stpcpy (z, " OTAGS;grep -Fv '\t");
+-	  z = stpcpy (z, argbuffer[i].what);
+-	  z = stpcpy (z, "\t' OTAGS >");
+-	  z = stpcpy (z, tagfile);
+-	  strcpy (z, ";rm OTAGS");
+-	  if (system (cmd) != EXIT_SUCCESS)
+-	    fatal ("failed to execute shell command");
+          clean_matched_file_tag (tagfile, argbuffer[i].what);
+ 	}
+-      free (cmd);
+       append_to_tagfile = true;
+     }
+ 
+@@ -1448,6 +1438,51 @@ main (int argc, char **argv)
+   return EXIT_SUCCESS;
+ }
+ 
+/*
+ * Equivalent to: mv tags OTAGS;grep -Fv ' filename ' OTAGS >tags;rm OTAGS
+ */
+static void
+clean_matched_file_tag (const char* tagfile, const char* match_file_name)
+{
+  FILE *otags_f = fopen ("OTAGS", "wb");
+  FILE *tag_f = fopen (tagfile, "rb");
+
+  if (otags_f == NULL)
+    pfatal ("OTAGS");
+
+  if (tag_f == NULL)
+    pfatal (tagfile);
+
+  int buf_len = strlen (match_file_name) + sizeof ("\t\t ") + 1;
+  char *buf = xmalloc (buf_len);
+  snprintf (buf, buf_len, "\t%s\t", match_file_name);
+
+  linebuffer line;
+  linebuffer_init (&line);
+  while (readline_internal (&line, tag_f, tagfile, true) > 0)
+    {
+      if (ferror (tag_f))
+        pfatal (tagfile);
+
+      if (strstr (line.buffer, buf) == NULL)
+        {
+          fprintf (otags_f, "%s\n", line.buffer);
+          if (ferror (tag_f))
+            pfatal (tagfile);
+        }
+    }
+  free (buf);
+  free (line.buffer);
+
+  if (fclose (otags_f) == EOF)
+    pfatal ("OTAGS");
+
+  if (fclose (tag_f) == EOF)
+    pfatal (tagfile);
+
+  do_move_file ("OTAGS", tagfile);
+  return;
+}
+ 
+ /*
+  * Return a compressor given the file name.  If EXTPTR is non-zero,
+@@ -1831,7 +1866,7 @@ find_entries (FILE *inf)
+ 
+   /* Else look for sharp-bang as the first two characters. */
+   if (parser == NULL
+-      && readline_internal (&lb, inf, infilename) > 0
+      && readline_internal (&lb, inf, infilename, false) > 0
+       && lb.len >= 2
+       && lb.buffer[0] == '#'
+       && lb.buffer[1] == '!')
+@@ -6878,7 +6913,7 @@ analyze_regex (char *regex_arg)
+ 	if (regexfp == NULL)
+ 	  pfatal (regexfile);
+ 	linebuffer_init (&regexbuf);
+-	while (readline_internal (&regexbuf, regexfp, regexfile) > 0)
+	while (readline_internal (&regexbuf, regexfp, regexfile, false) > 0)
+ 	  analyze_regex (regexbuf.buffer);
+ 	free (regexbuf.buffer);
+ 	if (fclose (regexfp) != 0)
+@@ -7226,11 +7261,13 @@ get_lispy_tag (register char *bp)
+ 
+ /*
+  * Read a line of text from `stream' into `lbp', excluding the
+- * newline or CR-NL, if any.  Return the number of characters read from
+- * `stream', which is the length of the line including the newline.
+ * newline or CR-NL (if `leave_cr` is false), if any.  Return the
+ * number of characters read from `stream', which is the length
+ * of the line including the newline.
+  *
+- * On DOS or Windows we do not count the CR character, if any before the
+- * NL, in the returned length; this mirrors the behavior of Emacs on those
+ * On DOS or Windows, if `leave_cr` is false, we do not count the
+ * CR character, if any before the NL, in the returned length;
+ * this mirrors the behavior of Emacs on those
+  * platforms (for text files, it translates CR-NL to NL as it reads in the
+  * file).
+  *
+@@ -7238,7 +7275,7 @@ get_lispy_tag (register char *bp)
+  * appended to `filebuf'.
+  */
+ static ptrdiff_t
+-readline_internal (linebuffer *lbp, FILE *stream, char const *filename)
+readline_internal (linebuffer *lbp, FILE *stream, char const *filename, const bool leave_cr)
+ {
+   char *buffer = lbp->buffer;
+   char *p = lbp->buffer;
+@@ -7268,19 +7305,19 @@ readline_internal (linebuffer *lbp, FILE *stream, char const *filename)
+ 	  break;
+ 	}
+       if (c == '\n')
+-	{
+-	  if (p > buffer && p[-1] == '\r')
+-	    {
+-	      p -= 1;
+-	      chars_deleted = 2;
+-	    }
+-	  else
+-	    {
+-	      chars_deleted = 1;
+-	    }
+-	  *p = '\0';
+-	  break;
+-	}
+        {
+          if (!leave_cr && p > buffer && p[-1] == '\r')
+            {
+              p -= 1;
+              chars_deleted = 2;
+            }
+          else
+            {
+              chars_deleted = 1;
+            }
+          *p = '\0';
+          break;
+        }
+       *p++ = c;
+     }
+   lbp->len = p - buffer;
+@@ -7311,7 +7348,7 @@ static void
+ readline (linebuffer *lbp, FILE *stream)
+ {
+   linecharno = charno;		/* update global char number of line start */
+-  ptrdiff_t result = readline_internal (lbp, stream, infilename);
+  ptrdiff_t result = readline_internal (lbp, stream, infilename, false);
+   lineno += 1;			/* increment global line number */
+   charno += result;		/* increment global char number */
+ 
+@@ -7669,6 +7706,46 @@ etags_mktmp (void)
+   return templt;
+ }
+ 
+static void
+do_move_file(const char *src_file, const char *dst_file)
+{
+  if (rename (src_file, dst_file) == 0)
+    return;
+
+  FILE *src_f = fopen (src_file, "rb");
+  FILE *dst_f = fopen (dst_file, "wb");
+
+  if (src_f == NULL)
+    pfatal (src_file);
+
+  if (dst_f == NULL)
+    pfatal (dst_file);
+
+  int c;
+  while ((c = fgetc (src_f)) != EOF)
+    {
+      if (ferror (src_f))
+        pfatal (src_file);
+
+      if (ferror (dst_f))
+        pfatal (dst_file);
+
+      if (fputc (c, dst_f) == EOF)
+        pfatal ("cannot write");
+    }
+
+  if (fclose (src_f) == EOF)
+    pfatal (src_file);
+
+  if (fclose (dst_f) == EOF)
+    pfatal (dst_file);
+
+  if (unlink (src_file) == -1)
+    pfatal ("unlink error");
+
+  return;
+}
+
+ /* Return a newly allocated string containing the file name of FILE
+    relative to the absolute directory DIR (which should end with a slash). */
+ static char *
+-- 
+cgit v1.1
--- a/emacs.spec
+++ b/emacs.spec
@ -8,7 +8,7 @@
 Name:          emacs
 Epoch:         1
 Version:       27.2
-Release:       7
+Release:       8
 Summary:       An extensible GNU text editor
 License:       GPLv3+ and CC0-1.0
 URL:           http://www.gnu.org/software/emacs
@ -25,6 +25,7 @@ Source8:       %{name}.appdata.xml
 Patch6001:        emacs-spellchecker.patch
 Patch6002:        emacs-system-crypto-policies.patch
 Patch6003:        backport-emacs-glibc-2.34.patch
+Patch6004:        backport-CVE-2022-45939.patch
 Patch9000:        emacs-deal-taboo-words.patch

 BuildRequires: gcc atk-devel cairo-devel freetype-devel fontconfig-devel dbus-devel giflib-devel
@ -407,6 +408,9 @@ fi
 %{_mandir}/*/*

 %changelog
+* Thu Dec 01 2022 wangkerong <wangkerong@h-partners.com> - 1:27.2-8
+- fix CVE-2022-45939
+
 * Fri Nov 18 2022 Wenlong Zhang<zhangwenlong@loongson.cn> - 1:27.2-7
 - add loongarch support for emacs