From: "Lars Wendler" <polynomial-c@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] repo/gentoo:master commit in: app-shells/bash/files/, app-shells/bash/
Date: Tue, 20 Sep 2016 14:59:52 +0000 (UTC) [thread overview]
Message-ID: <1474383584.7722e02ff41d7e30b1e2226d0cabd4458cd6567c.polynomial-c@gentoo> (raw)
commit: 7722e02ff41d7e30b1e2226d0cabd4458cd6567c
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Tue Sep 20 14:59:44 2016 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Tue Sep 20 14:59:44 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7722e02f
app-shells/bash: Revbump to fix CVE-2016-0634 (bug #594496).
Package-Manager: portage-2.3.1
Signed-off-by: Lars Wendler <polynomial-c <AT> gentoo.org>
app-shells/bash/bash-4.3_p46-r1.ebuild | 254 +++++++++++++++++++++
.../bash/files/bash-4.3-prompt-string-comsub.patch | 118 ++++++++++
2 files changed, 372 insertions(+)
diff --git a/app-shells/bash/bash-4.3_p46-r1.ebuild b/app-shells/bash/bash-4.3_p46-r1.ebuild
new file mode 100644
index 00000000..85d4eda
--- /dev/null
+++ b/app-shells/bash/bash-4.3_p46-r1.ebuild
@@ -0,0 +1,254 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+
+inherit eutils flag-o-matic toolchain-funcs multilib
+
+# Official patchlevel
+# See ftp://ftp.cwru.edu/pub/bash/bash-4.3-patches/
+PLEVEL=${PV##*_p}
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+[[ ${PV} != *_p* ]] && PLEVEL=0
+patches() {
+ local opt=$1 plevel=${2:-${PLEVEL}} pn=${3:-${PN}} pv=${4:-${MY_PV}}
+ [[ ${plevel} -eq 0 ]] && return 1
+ eval set -- {1..${plevel}}
+ set -- $(printf "${pn}${pv/\.}-%03d " "$@")
+ if [[ ${opt} == -s ]] ; then
+ echo "${@/#/${DISTDIR}/}"
+ else
+ local u
+ for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
+ printf "${u}/${pn}-${pv}-patches/%s " "$@"
+ done
+ fi
+}
+
+# The version of readline this bash normally ships with.
+READLINE_VER="6.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="http://tiswww.case.edu/php/chet/bash/bashtop.html"
+SRC_URI="mirror://gnu/bash/${MY_P}.tar.gz $(patches)"
+[[ ${PV} == *_rc* ]] && SRC_URI+=" ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd"
+IUSE="afs bashlogger examples mem-scramble +net nls plugins +readline vanilla"
+
+DEPEND=">=sys-libs/ncurses-5.2-r2:0=
+ readline? ( >=sys-libs/readline-${READLINE_VER}:0= )
+ nls? ( virtual/libintl )"
+RDEPEND="${DEPEND}
+ !<sys-apps/portage-2.1.6.7_p1
+ !<sys-apps/paludis-0.26.0_alpha5"
+# we only need yacc when the .y files get patched (bash42-005)
+DEPEND+=" virtual/yacc"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.3-mapfile-improper-array-name-validation.patch
+ "${FILESDIR}"/${PN}-4.3-arrayfunc.patch
+ "${FILESDIR}"/${PN}-4.3-protos.patch
+ # CVE-2016-0634 / bug #594496
+ "${FILESDIR}"/${PN}-4.3-prompt-string-comsub.patch
+)
+
+S=${WORKDIR}/${MY_P}
+
+pkg_setup() {
+ if is-flag -malign-double ; then #7332
+ eerror "Detected bad CFLAGS '-malign-double'. Do not use this"
+ eerror "as it breaks LFS (struct stat64) on x86."
+ die "remove -malign-double from your CFLAGS mr ricer"
+ fi
+ if use bashlogger ; then
+ ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+ ewarn "This will log ALL output you enter into the shell, you have been warned."
+ fi
+}
+
+src_unpack() {
+ unpack ${MY_P}.tar.gz
+}
+
+src_prepare() {
+ # Include official patches
+ [[ ${PLEVEL} -gt 0 ]] && epatch $(patches -s)
+
+ # Clean out local libs so we know we use system ones w/releases.
+ if [[ ${PV} != *_rc* ]] ; then
+ rm -rf lib/{readline,termcap}/*
+ touch lib/{readline,termcap}/Makefile.in # for config.status
+ sed -ri -e 's:\$[(](RL|HIST)_LIBSRC[)]/[[:alpha:]]*.h::g' Makefile.in || die
+ fi
+
+ # Avoid regenerating docs after patches #407985
+ sed -i -r '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in || die
+ touch -r . doc/*
+
+ epatch "${PATCHES[@]}"
+
+ epatch_user
+}
+
+src_configure() {
+ local myconf=()
+
+ # For descriptions of these, see config-top.h
+ # bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+ append-cppflags \
+ -DDEFAULT_PATH_VALUE=\'\"${EPREFIX}/usr/local/sbin:${EPREFIX}/usr/local/bin:${EPREFIX}/usr/sbin:${EPREFIX}/usr/bin:${EPREFIX}/sbin:${EPREFIX}/bin\"\' \
+ -DSTANDARD_UTILS_PATH=\'\"${EPREFIX}/bin:${EPREFIX}/usr/bin:${EPREFIX}/sbin:${EPREFIX}/usr/sbin\"\' \
+ -DSYS_BASHRC=\'\"${EPREFIX}/etc/bash/bashrc\"\' \
+ -DSYS_BASH_LOGOUT=\'\"${EPREFIX}/etc/bash/bash_logout\"\' \
+ -DNON_INTERACTIVE_LOGIN_SHELLS \
+ -DSSH_SOURCE_BASHRC \
+ -DUSE_MKTEMP -DUSE_MKSTEMP \
+ $(use bashlogger && echo -DSYSLOG_HISTORY)
+
+ # Don't even think about building this statically without
+ # reading Bug 7714 first. If you still build it statically,
+ # don't come crying to us with bugs ;).
+ #use static && export LDFLAGS="${LDFLAGS} -static"
+ use nls || myconf+=( --disable-nls )
+
+ # Historically, we always used the builtin readline, but since
+ # our handling of SONAME upgrades has gotten much more stable
+ # in the PM (and the readline ebuild itself preserves the old
+ # libs during upgrades), linking against the system copy should
+ # be safe.
+ # Exact cached version here doesn't really matter as long as it
+ # is at least what's in the DEPEND up above.
+ export ac_cv_rl_version=${READLINE_VER}
+
+ # Force linking with system curses ... the bundled termcap lib
+ # sucks bad compared to ncurses. For the most part, ncurses
+ # is here because readline needs it. But bash itself calls
+ # ncurses in one or two small places :(.
+
+ if [[ ${PV} != *_rc* ]] ; then
+ # Use system readline only with released versions.
+ myconf+=( --with-installed-readline=. )
+ fi
+
+ if use plugins; then
+ append-ldflags -Wl,-rpath,/usr/$(get_libdir)/bash
+ else
+ # Disable the plugins logic by hand since bash doesn't
+ # provide a way of doing it.
+ export ac_cv_func_dl{close,open,sym}=no \
+ ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+ sed -i \
+ -e '/LOCAL_LDFLAGS=/s:-rdynamic::' \
+ configure || die
+ fi
+ tc-export AR #444070
+ econf \
+ --docdir='$(datarootdir)'/doc/${PF} \
+ --htmldir='$(docdir)/html' \
+ --with-curses \
+ $(use_with afs) \
+ $(use_enable net net-redirections) \
+ --disable-profiling \
+ $(use_enable mem-scramble) \
+ $(use_with mem-scramble bash-malloc) \
+ $(use_enable readline) \
+ $(use_enable readline history) \
+ $(use_enable readline bang-history) \
+ "${myconf[@]}"
+}
+
+src_compile() {
+ emake
+
+ if use plugins ; then
+ emake -C examples/loadables all others
+ fi
+}
+
+src_install() {
+ local d f
+
+ default
+
+ dodir /bin
+ mv "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+ dosym bash /bin/rbash
+
+ insinto /etc/bash
+ doins "${FILESDIR}"/bash_logout
+ doins "${FILESDIR}"/bashrc
+ keepdir /etc/bash/bashrc.d
+ insinto /etc/skel
+ for f in bash{_logout,_profile,rc} ; do
+ newins "${FILESDIR}"/dot-${f} .${f}
+ done
+
+ local sed_args=(
+ -e "s:#${USERLAND}#@::"
+ -e '/#@/d'
+ )
+ if ! use readline ; then
+ sed_args+=( #432338
+ -e '/^shopt -s histappend/s:^:#:'
+ -e 's:use_color=true:use_color=false:'
+ )
+ fi
+ sed -i \
+ "${sed_args[@]}" \
+ "${ED}"/etc/skel/.bashrc \
+ "${ED}"/etc/bash/bashrc || die
+
+ if use plugins ; then
+ exeinto /usr/$(get_libdir)/bash
+ doexe $(echo examples/loadables/*.o | sed 's:\.o::g')
+ insinto /usr/include/bash-plugins
+ doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+ fi
+
+ if use examples ; then
+ for d in examples/{functions,misc,scripts,startup-files} ; do
+ exeinto /usr/share/doc/${PF}/${d}
+ insinto /usr/share/doc/${PF}/${d}
+ for f in ${d}/* ; do
+ if [[ ${f##*/} != PERMISSION ]] && [[ ${f##*/} != *README ]] ; then
+ doexe ${f}
+ else
+ doins ${f}
+ fi
+ done
+ done
+ fi
+
+ doman doc/*.1
+ newdoc CWRU/changelog ChangeLog
+ dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+ if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]] ; then
+ mkdir -p "${EROOT}"/etc/bash
+ mv -f "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/
+ fi
+
+ if [[ -L ${EROOT}/bin/sh ]] ; then
+ # rewrite the symlink to ensure that its mtime changes. having /bin/sh
+ # missing even temporarily causes a fatal error with paludis.
+ local target=$(readlink "${EROOT}"/bin/sh)
+ local tmp=$(emktemp "${EROOT}"/bin)
+ ln -sf "${target}" "${tmp}"
+ mv -f "${tmp}" "${EROOT}"/bin/sh
+ fi
+}
+
+pkg_postinst() {
+ # If /bin/sh does not exist, provide it
+ if [[ ! -e ${EROOT}/bin/sh ]] ; then
+ ln -sf bash "${EROOT}"/bin/sh
+ fi
+}
diff --git a/app-shells/bash/files/bash-4.3-prompt-string-comsub.patch b/app-shells/bash/files/bash-4.3-prompt-string-comsub.patch
new file mode 100644
index 00000000..175bc53
--- /dev/null
+++ b/app-shells/bash/files/bash-4.3-prompt-string-comsub.patch
@@ -0,0 +1,118 @@
+http://seclists.org/oss-sec/2016/q3/538
+https://bugs.gentoo.org/594496
+
+*** ../bash-4.3-patched/parse.y 2015-08-13 15:11:54.000000000 -0400
+--- parse.y 2016-03-07 15:44:14.000000000 -0500
+***************
+*** 5259,5263 ****
+ int result_size, result_index;
+ int c, n, i;
+! char *temp, octal_string[4];
+ struct tm *tm;
+ time_t the_time;
+--- 5259,5263 ----
+ int result_size, result_index;
+ int c, n, i;
+! char *temp, *t_host, octal_string[4];
+ struct tm *tm;
+ time_t the_time;
+***************
+*** 5407,5411 ****
+ case 's':
+ temp = base_pathname (shell_name);
+! temp = savestring (temp);
+ goto add_string;
+
+--- 5407,5415 ----
+ case 's':
+ temp = base_pathname (shell_name);
+! /* Try to quote anything the user can set in the file system */
+! if (promptvars || posixly_correct)
+! temp = sh_backslash_quote_for_double_quotes (temp);
+! else
+! temp = savestring (temp);
+ goto add_string;
+
+***************
+*** 5497,5503 ****
+ case 'h':
+ case 'H':
+! temp = savestring (current_host_name);
+! if (c == 'h' && (t = (char *)strchr (temp, '.')))
+ *t = '\0';
+ goto add_string;
+
+--- 5501,5515 ----
+ case 'h':
+ case 'H':
+! t_host = savestring (current_host_name);
+! if (c == 'h' && (t = (char *)strchr (t_host, '.')))
+ *t = '\0';
++ if (promptvars || posixly_correct)
++ /* Make sure that expand_prompt_string is called with a
++ second argument of Q_DOUBLE_QUOTES if we use this
++ function here. */
++ temp = sh_backslash_quote_for_double_quotes (t_host);
++ else
++ temp = savestring (t_host);
++ free (t_host);
+ goto add_string;
+
+*** ../bash-4.3-patched/y.tab.c 2015-08-13 15:11:54.000000000 -0400
+--- y.tab.c 2016-03-07 15:44:14.000000000 -0500
+***************
+*** 7571,7575 ****
+ int result_size, result_index;
+ int c, n, i;
+! char *temp, octal_string[4];
+ struct tm *tm;
+ time_t the_time;
+--- 7571,7575 ----
+ int result_size, result_index;
+ int c, n, i;
+! char *temp, *t_host, octal_string[4];
+ struct tm *tm;
+ time_t the_time;
+***************
+*** 7719,7723 ****
+ case 's':
+ temp = base_pathname (shell_name);
+! temp = savestring (temp);
+ goto add_string;
+
+--- 7719,7727 ----
+ case 's':
+ temp = base_pathname (shell_name);
+! /* Try to quote anything the user can set in the file system */
+! if (promptvars || posixly_correct)
+! temp = sh_backslash_quote_for_double_quotes (temp);
+! else
+! temp = savestring (temp);
+ goto add_string;
+
+***************
+*** 7809,7815 ****
+ case 'h':
+ case 'H':
+! temp = savestring (current_host_name);
+! if (c == 'h' && (t = (char *)strchr (temp, '.')))
+ *t = '\0';
+ goto add_string;
+
+--- 7813,7827 ----
+ case 'h':
+ case 'H':
+! t_host = savestring (current_host_name);
+! if (c == 'h' && (t = (char *)strchr (t_host, '.')))
+ *t = '\0';
++ if (promptvars || posixly_correct)
++ /* Make sure that expand_prompt_string is called with a
++ second argument of Q_DOUBLE_QUOTES if we use this
++ function here. */
++ temp = sh_backslash_quote_for_double_quotes (t_host);
++ else
++ temp = savestring (t_host);
++ free (t_host);
+ goto add_string;
+
+
next reply other threads:[~2016-09-20 14:59 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-20 14:59 Lars Wendler [this message]
-- strict thread matches above, loose matches on Subject: below --
2025-07-19 6:26 [gentoo-commits] repo/gentoo:master commit in: app-shells/bash/files/, app-shells/bash/ Sam James
2025-05-04 4:59 Sam James
2023-12-02 4:26 Sam James
2023-11-11 0:21 Sam James
2023-06-23 2:32 Sam James
2023-02-09 4:08 Sam James
2022-10-08 13:25 Sam James
2022-06-13 19:38 Sam James
2021-01-07 0:48 Lars Wendler
2020-12-07 13:18 Lars Wendler
2019-08-15 10:50 Lars Wendler
2019-04-21 9:16 Lars Wendler
2019-03-08 20:56 Lars Wendler
2019-01-15 1:05 Thomas Deutschmann
2019-01-09 17:50 Lars Wendler
2016-11-27 1:45 Mike Frysinger
2016-11-10 6:03 Mike Frysinger
2016-01-26 7:23 Mike Frysinger
2015-10-20 20:35 Mike Frysinger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1474383584.7722e02ff41d7e30b1e2226d0cabd4458cd6567c.polynomial-c@gentoo \
--to=polynomial-c@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox