bug#59544: [PATCH] Fixed lib-src/etags.c command execute vulnerability

["lux" <lx@shellcodes.org>]

[-- Attachment #1.1: Type: text/plain, Size: 222 bytes --]

> That's a possibility, yes.  Although I doubt that people are still using
> ctags that comes with Emacs (this code fragment runs only in ctags, not in
> etags).


I rewrote this code, not use system(1).

[-- Attachment #1.2: Type: text/html, Size: 417 bytes --]

[-- Attachment #2: 0001-Fixed-lib-src-etags.c-command-execute-vulnerability.patch --]
[-- Type: application/octet-stream, Size: 2104 bytes --]

From d6bc71f8640efe7caa2657a75c5aa4d8b4f0532c Mon Sep 17 00:00:00 2001
From: lu4nx <lx@shellcodes.org>
Date: Fri, 25 Nov 2022 14:38:29 +0800
Subject: [PATCH] * Fixed lib-src/etags.c command execute vulnerability

---
 lib-src/etags.c | 44 +++++++++++++++++++++++++++++++-------------
 1 file changed, 31 insertions(+), 13 deletions(-)

diff --git a/lib-src/etags.c b/lib-src/etags.c
index f665f35fa6..1bb352f565 100644
--- a/lib-src/etags.c
+++ b/lib-src/etags.c
@@ -1387,9 +1387,11 @@ main (int argc, char **argv)
   /* From here on, we are in (CTAGS && !cxref_style) */
   if (update)
     {
-      char *cmd =
-	xmalloc (strlen (tagfile) + whatlen_max +
-		 sizeof "mv..OTAGS;grep -Fv '\t\t' OTAGS >;rm OTAGS");
+      FILE *otags_f, *tag_f;
+      int buf_len;
+      char *buf;
+      char line[512];
+
       for (i = 0; i < current_arg; ++i)
 	{
 	  switch (argbuffer[i].arg_type)
@@ -1400,17 +1402,33 @@ main (int argc, char **argv)
 	    default:
 	      continue;		/* the for loop */
 	    }
-	  char *z = stpcpy (cmd, "mv ");
-	  z = stpcpy (z, tagfile);
-	  z = stpcpy (z, " OTAGS;grep -Fv '\t");
-	  z = stpcpy (z, argbuffer[i].what);
-	  z = stpcpy (z, "\t' OTAGS >");
-	  z = stpcpy (z, tagfile);
-	  strcpy (z, ";rm OTAGS");
-	  if (system (cmd) != EXIT_SUCCESS)
-	    fatal ("failed to execute shell command");
+
+          otags_f = fopen ("OTAGS", "w");
+          tag_f = fopen (tagfile, "r");
+
+          if (otags_f == NULL)
+            pfatal ("OTAGS");
+
+          if (tag_f == NULL)
+            pfatal (tagfile);
+
+          buf_len = strlen (argbuffer[i].what) + sizeof ("\t\t ") + 1;
+          buf = xmalloc (buf_len);
+          snprintf (buf, buf_len, "\t%s\t", argbuffer[i].what);
+
+          while (fgets (line, sizeof (line), tag_f) != NULL)
+            {
+              if (strstr (line, buf) == NULL)
+                fputs (line, otags_f);
+            }
+
+          fclose (otags_f);
+          fclose (tag_f);
+
+          rename ("OTAGS", tagfile);
+          unlink ("OTAGS");
 	}
-      free (cmd);
+
       append_to_tagfile = true;
     }
 
-- 
2.38.1