From mboxrd@z Thu Jan 1 00:00:00 1970 From: Efraim Flashner Subject: Re: [PATCH 1/1] gnu: tcsh: Fix out of bounds read. Date: Wed, 7 Dec 2016 10:09:47 +0200 Message-ID: <20161207080947.GA26434@macbook42.flashner.co.il> References: Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="5vNYLRcllDrimb99" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:35116) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cEXJU-0001lT-DM for guix-devel@gnu.org; Wed, 07 Dec 2016 03:10:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cEXJP-00038L-OR for guix-devel@gnu.org; Wed, 07 Dec 2016 03:10:52 -0500 Received: from flashner.co.il ([178.62.234.194]:46711) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cEXJP-00038G-Do for guix-devel@gnu.org; Wed, 07 Dec 2016 03:10:47 -0500 Content-Disposition: inline In-Reply-To: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org --5vNYLRcllDrimb99 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Dec 07, 2016 at 01:22:18AM -0500, Leo Famulari wrote: > * gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/shells.scm (tcsh)[source]: Use it. > --- > gnu/local.mk | 1 + > .../patches/tcsh-fix-out-of-bounds-read.patch | 31 ++++++++++++++++= ++++++ > gnu/packages/shells.scm | 3 ++- > 3 files changed, 34 insertions(+), 1 deletion(-) > create mode 100644 gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch >=20 > diff --git a/gnu/local.mk b/gnu/local.mk > index bc9b06da6..552272bbd 100644 > --- a/gnu/local.mk > +++ b/gnu/local.mk > @@ -879,6 +879,7 @@ dist_patch_DATA =3D \ > %D%/packages/patches/tclxml-3.2-install.patch \ > %D%/packages/patches/tcsh-do-not-define-BSDWAIT.patch \ > %D%/packages/patches/tcsh-fix-autotest.patch \ > + %D%/packages/patches/tcsh-fix-out-of-bounds-read.patch \ > %D%/packages/patches/teensy-loader-cli-help.patch \ > %D%/packages/patches/texi2html-document-encoding.patch \ > %D%/packages/patches/texi2html-i18n.patch \ > diff --git a/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch b/gnu= /packages/patches/tcsh-fix-out-of-bounds-read.patch > new file mode 100644 > index 000000000..48c294f78 > --- /dev/null > +++ b/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch > @@ -0,0 +1,31 @@ > +Fix out-of-bounds read in c_substitute(): > + > +http://seclists.org/oss-sec/2016/q4/612 > + > +Patch copied from upstream source repository: > + > +https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a= 91b94596 > + > +From 6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 Mon Sep 17 00:00:00 2001 > +From: christos > +Date: Fri, 2 Dec 2016 16:59:28 +0000 > +Subject: [PATCH] Fix out of bounds read (Brooks Davis) (reproduce by sta= rting > + tcsh and hitting tab at the prompt) > + > +--- > + ed.chared.c | 2 +- > + 1 file changed, 1 insertion(+), 1 deletion(-) > + > +diff --git a/ed.chared.c b/ed.chared.c > +index 1277e53..310393e 100644 > +--- ed.chared.c > ++++ ed.chared.c > +@@ -750,7 +750,7 @@ c_substitute(void) > + /* > + * If we found a history character, go expand it. > + */ > +- if (HIST !=3D '\0' && *p =3D=3D HIST) > ++ if (p >=3D InputBuf && HIST !=3D '\0' && *p =3D=3D HIST) > + nr_exp =3D c_excl(p); > + else > + nr_exp =3D 0; > diff --git a/gnu/packages/shells.scm b/gnu/packages/shells.scm > index f3350ef50..8596efc87 100644 > --- a/gnu/packages/shells.scm > +++ b/gnu/packages/shells.scm > @@ -186,7 +186,8 @@ has a small feature set similar to a traditional Bour= ne shell.") > (base32 > "1a4z9kwgx1iqqzvv64si34m60gj34p7lp6rrcrb59s7ka5wa476q")) > (patches (search-patches "tcsh-fix-autotest.patch" > - "tcsh-do-not-define-BSDWAIT.patch= ")) > + "tcsh-do-not-define-BSDWAIT.patch" > + "tcsh-fix-out-of-bounds-read.patc= h")) > (patch-flags '("-p0")))) > (build-system gnu-build-system) > (inputs > --=20 > 2.11.0 >=20 >=20 Still no CVE assigned to it? Building the following 429 packages would ensure 829 dependent packages are= rebuilt Looks like it'll need to be grafted in addition. --=20 Efraim Flashner =D7=90=D7=A4=D7=A8=D7=99=D7=9D = =D7=A4=D7=9C=D7=A9=D7=A0=D7=A8 GPG key =3D A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 Confidentiality cannot be guaranteed on emails sent or received unencrypted --5vNYLRcllDrimb99 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEkVdB/rIvpOM7bo+N9MHTkX6s7pMFAlhHw7wACgkQ9MHTkX6s 7pOWBw//XPPw8QwBDrx4sthxusv/hVGqLj8L4fLGPtRLKZanUX9nDsBMednb1oJd Pk48BB2KZKD8kLANKv9/zQQPxtW1rt1OoJIUnFRZGPl8YZC+yFBNzUe9CnmvRgha KzmrB+z2YiM73r81JF1A2c3pCzbrlIIvue8eoRPDh9l8+yrdykfG4H/P7HVlsOMp NhTVa9/lCvf2mCMXegiMGiIW5l4dHhfBrG2iFr6uaGtzqFby8Bu2pYRXlcFF8SZb PiYbYbWPeyMALue4xpw35tLdhoZH/ge4NZ+w7F2Y4nrjzs/9ZSbJeqq0ZTNcE239 ZDVWkBQAz0+OOOm5in0FuekRxaFAZgz6rXhqjkE1F5dOen1y44cutPla4aQLwumK 1bCot+hIwgYoS+C3uZqDcAtFJIqC9e/1CQgeyJCWMr1LecVpjGvnjCzJWBAQwNxR v0l9Hsbo1nWiIT/YepqVnNdiDstndU8FKyxeSyMFDp73265+oTLw018pMj1epVD2 yfmPoq2jR6vHbqtLRRwxGvOAWACSQxMOdqXk2wfelvAXR9qCP5NEEMHyYyb1ckCq QAdUoylZqUzRG8uWHHdzHtNK7CHf/QIj+SQXEcFrhXBPz98uHdA/HTFnVMGLOu04 GPhGphx+gTbvn55bX3KKeu+cDGLcqMjMNlZLK+24HKoesDvVeB0= =hpSg -----END PGP SIGNATURE----- --5vNYLRcllDrimb99--