From: lux <lx@shellcodes.org>
To: Eli Zaretskii <eliz@gnu.org>, Troy Hinckley <comms@dabrev.com>
Cc: emacs-devel@gnu.org
Subject: Re: Request to backport fix for CVE-2022-45939 to Emacs 28
Date: Tue, 14 Feb 2023 13:07:44 +0800 [thread overview]
Message-ID: <tencent_EFC6F74E5CBE2EFC25F8831372C6B926AD05@qq.com> (raw)
In-Reply-To: <83sff9e1is.fsf@gnu.org>
[-- Attachment #1: Type: text/plain, Size: 1048 bytes --]
On Mon, 2023-02-13 at 22:47 +0200, Eli Zaretskii wrote:
> > Date: Mon, 13 Feb 2023 12:15:50 -0600
> > From: Troy Hinckley <comms@dabrev.com>
> >
> > My company will not allow an install of Emacs 28 due to CVE-2022-
> > 45939. There is a patch for this in the
> > master branch, but it did not make it in time for Emacs 28.2. We
> > have many Emacs users who would like to
> > upgrade to 28. What would be the effort to back port this fix and
> > do an Emacs 28.3 release?
>
> Unfortunately, we don't have the resources to produce another v28.x
> release. Emacs 29.1 will start its pretest soon, and will have this
> issue resolved when it is released, hopefully in a couple of months.
>
> Alternatively, you could ask the distro which you are using (if you
> are using a distro) to backport that patch to the Emacs 28 codebase.
> Or patch the sources yourself and build Emacs, if that is how you
> produce the binaries.
>
Hi, I can fix the CVE-2022-45939, this is a patch.
Eli, can you merge into emacs-28 branch?
[-- Attachment #2: 0001-lib-src-etags.c-Fix-CVE-2022-45939.patch --]
[-- Type: text/x-patch, Size: 7952 bytes --]
From 637d57282ab332abbbfed27000cdf6dbf9ecd20e Mon Sep 17 00:00:00 2001
From: Xi Lu <lx@shellcodes.org>
Date: Tue, 14 Feb 2023 12:58:04 +0800
Subject: [PATCH] ; * lib-src/etags.c: Fix CVE-2022-45939.
---
lib-src/etags.c | 149 ++++++++++++++++++++++++++++++++++++------------
1 file changed, 113 insertions(+), 36 deletions(-)
diff --git a/lib-src/etags.c b/lib-src/etags.c
index f665f35fa60..c9c32691016 100644
--- a/lib-src/etags.c
+++ b/lib-src/etags.c
@@ -382,7 +382,7 @@ #define xrnew(op, n, m) ((op) = xnrealloc (op, n, (m) * sizeof *(op)))
static language *get_language_from_langname (const char *);
static void readline (linebuffer *, FILE *);
-static ptrdiff_t readline_internal (linebuffer *, FILE *, char const *);
+static ptrdiff_t readline_internal (linebuffer *, FILE *, char const *, const bool);
static bool nocase_tail (const char *);
static void get_tag (char *, char **);
static void get_lispy_tag (char *);
@@ -406,7 +406,9 @@ #define xrnew(op, n, m) ((op) = xnrealloc (op, n, (m) * sizeof *(op)))
static void pfnote (char *, bool, char *, ptrdiff_t, intmax_t, intmax_t);
static void invalidate_nodes (fdesc *, node **);
static void put_entries (node *);
+static void clean_matched_file_tag (char const * const, char const * const);
+static void do_move_file (const char *, const char *);
static char *concat (const char *, const char *, const char *);
static char *skip_spaces (char *);
static char *skip_non_spaces (char *);
@@ -1339,7 +1341,7 @@ main (int argc, char **argv)
if (parsing_stdin)
fatal ("cannot parse standard input "
"AND read file names from it");
- while (readline_internal (&filename_lb, stdin, "-") > 0)
+ while (readline_internal (&filename_lb, stdin, "-", false) > 0)
process_file_name (filename_lb.buffer, lang);
}
else
@@ -1387,9 +1389,6 @@ main (int argc, char **argv)
/* From here on, we are in (CTAGS && !cxref_style) */
if (update)
{
- char *cmd =
- xmalloc (strlen (tagfile) + whatlen_max +
- sizeof "mv..OTAGS;grep -Fv '\t\t' OTAGS >;rm OTAGS");
for (i = 0; i < current_arg; ++i)
{
switch (argbuffer[i].arg_type)
@@ -1400,17 +1399,8 @@ main (int argc, char **argv)
default:
continue; /* the for loop */
}
- char *z = stpcpy (cmd, "mv ");
- z = stpcpy (z, tagfile);
- z = stpcpy (z, " OTAGS;grep -Fv '\t");
- z = stpcpy (z, argbuffer[i].what);
- z = stpcpy (z, "\t' OTAGS >");
- z = stpcpy (z, tagfile);
- strcpy (z, ";rm OTAGS");
- if (system (cmd) != EXIT_SUCCESS)
- fatal ("failed to execute shell command");
+ clean_matched_file_tag (tagfile, argbuffer[i].what);
}
- free (cmd);
append_to_tagfile = true;
}
@@ -1439,6 +1429,51 @@ main (int argc, char **argv)
return EXIT_SUCCESS;
}
+/*
+ * Equivalent to: mv tags OTAGS;grep -Fv ' filename ' OTAGS >tags;rm OTAGS
+ */
+static void
+clean_matched_file_tag (const char* tagfile, const char* match_file_name)
+{
+ FILE *otags_f = fopen ("OTAGS", "wb");
+ FILE *tag_f = fopen (tagfile, "rb");
+
+ if (otags_f == NULL)
+ pfatal ("OTAGS");
+
+ if (tag_f == NULL)
+ pfatal (tagfile);
+
+ int buf_len = strlen (match_file_name) + sizeof ("\t\t ") + 1;
+ char *buf = xmalloc (buf_len);
+ snprintf (buf, buf_len, "\t%s\t", match_file_name);
+
+ linebuffer line;
+ linebuffer_init (&line);
+ while (readline_internal (&line, tag_f, tagfile, true) > 0)
+ {
+ if (ferror (tag_f))
+ pfatal (tagfile);
+
+ if (strstr (line.buffer, buf) == NULL)
+ {
+ fprintf (otags_f, "%s\n", line.buffer);
+ if (ferror (tag_f))
+ pfatal (tagfile);
+ }
+ }
+ free (buf);
+ free (line.buffer);
+
+ if (fclose (otags_f) == EOF)
+ pfatal ("OTAGS");
+
+ if (fclose (tag_f) == EOF)
+ pfatal (tagfile);
+
+ do_move_file ("OTAGS", tagfile);
+ return;
+}
/*
* Return a compressor given the file name. If EXTPTR is non-zero,
@@ -1822,7 +1857,7 @@ find_entries (FILE *inf)
/* Else look for sharp-bang as the first two characters. */
if (parser == NULL
- && readline_internal (&lb, inf, infilename) > 0
+ && readline_internal (&lb, inf, infilename, false) > 0
&& lb.len >= 2
&& lb.buffer[0] == '#'
&& lb.buffer[1] == '!')
@@ -6861,7 +6896,7 @@ analyze_regex (char *regex_arg)
if (regexfp == NULL)
pfatal (regexfile);
linebuffer_init (®exbuf);
- while (readline_internal (®exbuf, regexfp, regexfile) > 0)
+ while (readline_internal (®exbuf, regexfp, regexfile, false) > 0)
analyze_regex (regexbuf.buffer);
free (regexbuf.buffer);
if (fclose (regexfp) != 0)
@@ -7209,11 +7244,13 @@ get_lispy_tag (register char *bp)
/*
* Read a line of text from `stream' into `lbp', excluding the
- * newline or CR-NL, if any. Return the number of characters read from
- * `stream', which is the length of the line including the newline.
+ * newline or CR-NL (if `leave_cr` is false), if any. Return the
+ * number of characters read from `stream', which is the length
+ * of the line including the newline.
*
- * On DOS or Windows we do not count the CR character, if any before the
- * NL, in the returned length; this mirrors the behavior of Emacs on those
+ * On DOS or Windows, if `leave_cr` is false, we do not count the
+ * CR character, if any before the NL, in the returned length;
+ * this mirrors the behavior of Emacs on those
* platforms (for text files, it translates CR-NL to NL as it reads in the
* file).
*
@@ -7221,7 +7258,7 @@ get_lispy_tag (register char *bp)
* appended to `filebuf'.
*/
static ptrdiff_t
-readline_internal (linebuffer *lbp, FILE *stream, char const *filename)
+readline_internal (linebuffer *lbp, FILE *stream, char const *filename, const bool leave_cr)
{
char *buffer = lbp->buffer;
char *p = lbp->buffer;
@@ -7251,19 +7288,19 @@ readline_internal (linebuffer *lbp, FILE *stream, char const *filename)
break;
}
if (c == '\n')
- {
- if (p > buffer && p[-1] == '\r')
- {
- p -= 1;
- chars_deleted = 2;
- }
- else
- {
- chars_deleted = 1;
- }
- *p = '\0';
- break;
- }
+ {
+ if (!leave_cr && p > buffer && p[-1] == '\r')
+ {
+ p -= 1;
+ chars_deleted = 2;
+ }
+ else
+ {
+ chars_deleted = 1;
+ }
+ *p = '\0';
+ break;
+ }
*p++ = c;
}
lbp->len = p - buffer;
@@ -7294,7 +7331,7 @@ readline_internal (linebuffer *lbp, FILE *stream, char const *filename)
readline (linebuffer *lbp, FILE *stream)
{
linecharno = charno; /* update global char number of line start */
- ptrdiff_t result = readline_internal (lbp, stream, infilename);
+ ptrdiff_t result = readline_internal (lbp, stream, infilename, false);
lineno += 1; /* increment global line number */
charno += result; /* increment global char number */
@@ -7652,6 +7689,46 @@ etags_mktmp (void)
return templt;
}
+static void
+do_move_file(const char *src_file, const char *dst_file)
+{
+ if (rename (src_file, dst_file) == 0)
+ return;
+
+ FILE *src_f = fopen (src_file, "rb");
+ FILE *dst_f = fopen (dst_file, "wb");
+
+ if (src_f == NULL)
+ pfatal (src_file);
+
+ if (dst_f == NULL)
+ pfatal (dst_file);
+
+ int c;
+ while ((c = fgetc (src_f)) != EOF)
+ {
+ if (ferror (src_f))
+ pfatal (src_file);
+
+ if (ferror (dst_f))
+ pfatal (dst_file);
+
+ if (fputc (c, dst_f) == EOF)
+ pfatal ("cannot write");
+ }
+
+ if (fclose (src_f) == EOF)
+ pfatal (src_file);
+
+ if (fclose (dst_f) == EOF)
+ pfatal (dst_file);
+
+ if (unlink (src_file) == -1)
+ pfatal ("unlink error");
+
+ return;
+}
+
/* Return a newly allocated string containing the file name of FILE
relative to the absolute directory DIR (which should end with a slash). */
static char *
--
2.39.1
next prev parent reply other threads:[~2023-02-14 5:07 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <85f35c42-cfe8-44a7-a9c1-307acc5c17d4@Spark>
2023-02-13 18:15 ` Request to backport fix for CVE-2022-45939 to Emacs 28 Troy Hinckley
2023-02-13 20:47 ` Eli Zaretskii
2023-02-14 5:07 ` lux [this message]
2023-02-14 13:19 ` Eli Zaretskii
2023-02-14 16:09 ` Troy Hinckley
2023-02-14 17:04 ` Eli Zaretskii
2023-02-17 1:44 ` Lynn Winebarger
2023-02-17 2:35 ` lux
2023-02-14 20:10 ` Tim Cross
2023-02-15 8:32 ` Robert Pluim
2023-02-18 4:19 ` Richard Stallman
2023-02-15 12:28 ` Eli Zaretskii
2023-02-16 17:50 ` Richard Stallman
2023-02-16 20:02 ` Eli Zaretskii
2023-02-16 20:41 ` Jim Porter
2023-02-16 20:52 ` Eli Zaretskii
2023-02-17 10:26 ` Stefan Kangas
2023-02-17 10:38 ` Robert Pluim
2023-02-17 12:33 ` Eli Zaretskii
2023-02-17 14:01 ` Stefan Kangas
2023-02-17 17:37 ` lux
2023-02-18 6:54 ` lux
2023-02-19 20:33 ` Corwin Brust
2023-02-21 14:54 ` Michael Albinus
2023-02-19 4:47 ` Richard Stallman
2023-02-19 7:05 ` Eli Zaretskii
2023-02-14 8:13 ` Robert Pluim
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/emacs/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=tencent_EFC6F74E5CBE2EFC25F8831372C6B926AD05@qq.com \
--to=lx@shellcodes.org \
--cc=comms@dabrev.com \
--cc=eliz@gnu.org \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).