gnu: tcsh: Fix out of bounds read.

* gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/shells.scm (tcsh)[replacement]: New field.
(tcsh/fixed): New variable.
This commit is contained in:
Leo Famulari 2016-12-07 18:51:27 -05:00
parent a2c1dceadd
commit 57513498de
No known key found for this signature in database
GPG Key ID: 2646FA30BACA7F08
3 changed files with 42 additions and 0 deletions

View File

@ -885,6 +885,7 @@ dist_patch_DATA = \
%D%/packages/patches/tclxml-3.2-install.patch \ %D%/packages/patches/tclxml-3.2-install.patch \
%D%/packages/patches/tcsh-do-not-define-BSDWAIT.patch \ %D%/packages/patches/tcsh-do-not-define-BSDWAIT.patch \
%D%/packages/patches/tcsh-fix-autotest.patch \ %D%/packages/patches/tcsh-fix-autotest.patch \
%D%/packages/patches/tcsh-fix-out-of-bounds-read.patch \
%D%/packages/patches/teensy-loader-cli-help.patch \ %D%/packages/patches/teensy-loader-cli-help.patch \
%D%/packages/patches/texi2html-document-encoding.patch \ %D%/packages/patches/texi2html-document-encoding.patch \
%D%/packages/patches/texi2html-i18n.patch \ %D%/packages/patches/texi2html-i18n.patch \

View File

@ -0,0 +1,31 @@
Fix out-of-bounds read in c_substitute():
http://seclists.org/oss-sec/2016/q4/612
Patch copied from upstream source repository:
https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596
From 6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 Mon Sep 17 00:00:00 2001
From: christos <christos>
Date: Fri, 2 Dec 2016 16:59:28 +0000
Subject: [PATCH] Fix out of bounds read (Brooks Davis) (reproduce by starting
tcsh and hitting tab at the prompt)
---
ed.chared.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ed.chared.c b/ed.chared.c
index 1277e53..310393e 100644
--- ed.chared.c
+++ ed.chared.c
@@ -750,7 +750,7 @@ c_substitute(void)
/*
* If we found a history character, go expand it.
*/
- if (HIST != '\0' && *p == HIST)
+ if (p >= InputBuf && HIST != '\0' && *p == HIST)
nr_exp = c_excl(p);
else
nr_exp = 0;

View File

@ -174,6 +174,7 @@ has a small feature set similar to a traditional Bourne shell.")
(define-public tcsh (define-public tcsh
(package (package
(name "tcsh") (name "tcsh")
(replacement tcsh/fixed)
(version "6.18.01") (version "6.18.01")
(source (origin (source (origin
(method url-fetch) (method url-fetch)
@ -231,6 +232,15 @@ command-line editor, programmable word completion, spelling correction, a
history mechanism, job control and a C-like syntax.") history mechanism, job control and a C-like syntax.")
(license bsd-4))) (license bsd-4)))
(define tcsh/fixed
(package
(inherit tcsh)
(name "tcsh")
(source (origin
(inherit (package-source tcsh))
(patches (cons (search-patch "tcsh-fix-out-of-bounds-read.patch")
(origin-patches (package-source tcsh))))))))
(define-public zsh (define-public zsh
(package (package
(name "zsh") (name "zsh")