From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 1/1] gnu: tcsh: Fix out of bounds read. Date: Wed, 7 Dec 2016 01:22:18 -0500 Message-ID: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:44687) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cEVcb-0004Yc-HG for guix-devel@gnu.org; Wed, 07 Dec 2016 01:22:30 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cEVcY-0000AC-00 for guix-devel@gnu.org; Wed, 07 Dec 2016 01:22:29 -0500 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:55664) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cEVcX-00009q-QA for guix-devel@gnu.org; Wed, 07 Dec 2016 01:22:25 -0500 Received: from localhost.localdomain (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 5862F7E430 for ; Wed, 7 Dec 2016 01:22:23 -0500 (EST) List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org * gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/shells.scm (tcsh)[source]: Use it. --- gnu/local.mk | 1 + .../patches/tcsh-fix-out-of-bounds-read.patch | 31 ++++++++++++++++++++++ gnu/packages/shells.scm | 3 ++- 3 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch diff --git a/gnu/local.mk b/gnu/local.mk index bc9b06da6..552272bbd 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -879,6 +879,7 @@ dist_patch_DATA = \ %D%/packages/patches/tclxml-3.2-install.patch \ %D%/packages/patches/tcsh-do-not-define-BSDWAIT.patch \ %D%/packages/patches/tcsh-fix-autotest.patch \ + %D%/packages/patches/tcsh-fix-out-of-bounds-read.patch \ %D%/packages/patches/teensy-loader-cli-help.patch \ %D%/packages/patches/texi2html-document-encoding.patch \ %D%/packages/patches/texi2html-i18n.patch \ diff --git a/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch b/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch new file mode 100644 index 000000000..48c294f78 --- /dev/null +++ b/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch @@ -0,0 +1,31 @@ +Fix out-of-bounds read in c_substitute(): + +http://seclists.org/oss-sec/2016/q4/612 + +Patch copied from upstream source repository: + +https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 + +From 6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 Mon Sep 17 00:00:00 2001 +From: christos +Date: Fri, 2 Dec 2016 16:59:28 +0000 +Subject: [PATCH] Fix out of bounds read (Brooks Davis) (reproduce by starting + tcsh and hitting tab at the prompt) + +--- + ed.chared.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ed.chared.c b/ed.chared.c +index 1277e53..310393e 100644 +--- ed.chared.c ++++ ed.chared.c +@@ -750,7 +750,7 @@ c_substitute(void) + /* + * If we found a history character, go expand it. + */ +- if (HIST != '\0' && *p == HIST) ++ if (p >= InputBuf && HIST != '\0' && *p == HIST) + nr_exp = c_excl(p); + else + nr_exp = 0; diff --git a/gnu/packages/shells.scm b/gnu/packages/shells.scm index f3350ef50..8596efc87 100644 --- a/gnu/packages/shells.scm +++ b/gnu/packages/shells.scm @@ -186,7 +186,8 @@ has a small feature set similar to a traditional Bourne shell.") (base32 "1a4z9kwgx1iqqzvv64si34m60gj34p7lp6rrcrb59s7ka5wa476q")) (patches (search-patches "tcsh-fix-autotest.patch" - "tcsh-do-not-define-BSDWAIT.patch")) + "tcsh-do-not-define-BSDWAIT.patch" + "tcsh-fix-out-of-bounds-read.patch")) (patch-flags '("-p0")))) (build-system gnu-build-system) (inputs -- 2.11.0