pmodules/bash
0
0
Fork 0
mirror of https://https.git.savannah.gnu.org/git/bash.git synced 2026-07-16 00:20:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

commit bash-20141003 snapshot

Browse Source
This commit is contained in:
Chet Ramey
2014-10-09 20:25:14 -04:00
parent 30595b57d9
commit 613d4ba419
30 changed files with 6247 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/exportfunc.right
+16
View File
@@ -0,0 +1,16 @@
exportfunc ok 1
exportfunc ok 2
./exportfunc.tests: line 24: cve7169-bad: No such file or directory
./exportfunc.tests: eval: line 30: syntax error: unexpected end of file
./exportfunc.tests: line 30: cve7169-bad2: No such file or directory
./exportfunc1.sub: line 1: maximum here-document count exceeded
/usr/local/build/bash/bash-current/bash: warning: here-document at line 0 delimited by end-of-file (wanted `a')
./exportfunc.tests: line 51: HELLO_WORLD: No such file or directory
eval ok
./exportfunc3.sub: line 10: export: foo=bar: cannot export
status: 1
equals-1
/usr/local/build/bash/bash-current/bash: foo=bar: command not found
bad echo
./exportfunc3.sub: line 23: export: /bin/echo: cannot export
bar
tests/exportfunc.tests
+71
View File
@@ -0,0 +1,71 @@
# normal operation
foo()
{
echo exportfunc ok 1
}
export -f foo
${THIS_SH} -c foo
unset -f foo
foo-a ()
{
echo exportfunc ok 2
}
export -f foo-a
${THIS_SH} -c 'foo-a'
# CVE-2014-6271
env -i BASH_FUNC_foo%%='() { echo cve6271 ok; } ; echo BAD' ${THIS_SH} -c foo 2>/dev/null
# CVE-2014-7169
rm -f cve7169-bad
env -i BASH_FUNC_X%%='() { (a)=>\' ${THIS_SH} -c cve7169-bad 2>/dev/null
: < cve7169-bad
rm -f cve7169-bad
echo cve7169-bad2 > bar
rm -f cve7169-bad2
eval 'X() { (a)>\' ; . ./bar 2>/dev/null
: < cve7169-bad2
rm -f cve7169-bad2 bar
# CVE-2014-7186
${THIS_SH} ./exportfunc1.sub
# CVE-2014-7187
${THIS_SH} ./exportfunc2.sub
# CVE-2014-6277
env BASH_FUNC_foo%%="() { 000(){>0;}&000(){ 0;}<<0 0" ${THIS_SH} -c foo 2>/dev/null
env BASH_FUNC_foo%%="() { 000(){>0;}&000(){ 0;}<<`perl -e '{print "A"x100000}'` 0" ${THIS_SH} -c foo 2>/dev/null
${THIS_SH} -c "f(){ x(){ _;}; x(){ _;}<<a;}"
# CVE-2014-6278
env 'BASH_FUNC_FOO%%=() { 0;}>r[0${$(}0 {>"$(id >/dev/tty)"; }' ${THIS_SH} -c : 2>/dev/null
rm -f HELLO_WORLD
env BASH_FUNC_FOO%%='() { 0;}>r[0${$(}0 {>HELLO_WORLD; }' ${THIS_SH} -c : 2>/dev/null
: < HELLO_WORLD
env BASH_FUNC_x%%='() { _;}>_[$($())] { echo vuln;}' ${THIS_SH} -c : 2>/dev/null
env -i BASH_FUNC_x%%='() { _; } >_[${ $() }] { id; }' ${THIS_SH} -c : 2>/dev/null
env BASH_FUNC_x%%=$'() { _;}>_[$($())]\n{ echo vuln;}' ${THIS_SH} -c : 2>/dev/null
eval 'x() { _;}>_[$($())] { echo vuln;}' 2>/dev/null
eval 'foo() { _; } >_[${ $() }] ;{ echo eval ok; }'
# other tests fixed in bash43-030 concerning function name transformation
env $'BASH_FUNC_\nfoo%%=() { echo transform-1; }' ${THIS_SH} -c foo 2>/dev/null
env $'BASH_FUNC_foo\n%%=() { echo transform-2; }' ${THIS_SH} -c foo 2>/dev/null
env $'BASH_FUNC_ foo %%=() { echo transform-3; }' ${THIS_SH} -c foo 2>/dev/null
unset -f foo
env $'BASH_FUNC_#badname%%'=$'() { :; }\nfoo () { echo transform-4; } ' ${THIS_SH} -c 'foo' 2>/dev/null
# tests of exported names
${THIS_SH} ./exportfunc3.sub
tests/exportfunc.tests~
+68
View File
@@ -0,0 +1,68 @@
# normal operation
foo()
{
echo exportfunc ok 1
}
export -f foo
${THIS_SH} -c foo
unset -f foo
foo-a ()
{
echo exportfunc ok 2
}
export -f foo-a
${THIS_SH} -c 'foo-a'
# CVE-2014-6271
env -i BASH_FUNC_foo%%='() { echo cve6271 ok; } ; echo BAD' ${THIS_SH} -c foo 2>/dev/null
# CVE-2014-7169
rm -f cve7169-bad
env -i BASH_FUNC_X%%='() { (a)=>\' ${THIS_SH} -c cve7169-bad 2>/dev/null
: < cve7169-bad
rm -f cve7169-bad
echo cve7169-bad2 > bar
rm -f cve7169-bad2
eval 'X() { (a)>\' ; . ./bar 2>/dev/null
: < cve7169-bad2
rm -f cve7169-bad2 bar
# CVE-2014-7186
${THIS_SH} ./exportfunc1.sub
# CVE-2014-7187
${THIS_SH} ./exportfunc2.sub
# CVE-2014-6277
env BASH_FUNC_foo%%="() { 000(){>0;}&000(){ 0;}<<0 0" ${THIS_SH} -c foo 2>/dev/null
env BASH_FUNC_foo%%="() { 000(){>0;}&000(){ 0;}<<`perl -e '{print "A"x100000}'` 0" ${THIS_SH} -c foo 2>/dev/null
${THIS_SH} -c "f(){ x(){ _;}; x(){ _;}<<a;}"
# CVE-2014-6278
env 'BASH_FUNC_FOO%%=() { 0;}>r[0${$(}0 {>"$(id >/dev/tty)"; }' ${THIS_SH} -c : 2>/dev/null
rm -f HELLO_WORLD
env BASH_FUNC_FOO%%='() { 0;}>r[0${$(}0 {>HELLO_WORLD; }' ${THIS_SH} -c : 2>/dev/null
: < HELLO_WORLD
env BASH_FUNC_x%%='() { _;}>_[$($())] { echo vuln;}' ${THIS_SH} -c : 2>/dev/null
env -i BASH_FUNC_x%%='() { _; } >_[${ $() }] { id; }' ${THIS_SH} -c : 2>/dev/null
env BASH_FUNC_x%%=$'() { _;}>_[$($())]\n{ echo vuln;}' ${THIS_SH} -c : 2>/dev/null
eval 'x() { _;}>_[$($())] { echo vuln;}' 2>/dev/null
eval 'foo() { _; } >_[${ $() }] ;{ echo eval ok; }'
# other tests fixed in bash43-030 concerning function name transformation
env $'BASH_FUNC_\nfoo%%=() { echo transform-1; }' ${THIS_SH} -c foo 2>/dev/null
env $'BASH_FUNC_foo\n%%=() { echo transform-2; }' ${THIS_SH} -c foo 2>/dev/null
env $'BASH_FUNC_ foo %%=() { echo transform-3; }' ${THIS_SH} -c foo 2>/dev/null
unset -f foo
env $'BASH_FUNC_#badname%%'=$'() { :; }\nfoo () { echo transform-4; } ' ${THIS_SH} -c 'foo' 2>/dev/null
tests/exportfunc1.sub
+21
View File
@@ -0,0 +1,21 @@
cat <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
EOF
echo after EOF
tests/exportfunc2.sub
+400
View File
@@ -0,0 +1,400 @@
for x1 in ; do :
for x2 in ; do :
for x3 in ; do :
for x4 in ; do :
for x5 in ; do :
for x6 in ; do :
for x7 in ; do :
for x8 in ; do :
for x9 in ; do :
for x10 in ; do :
for x11 in ; do :
for x12 in ; do :
for x13 in ; do :
for x14 in ; do :
for x15 in ; do :
for x16 in ; do :
for x17 in ; do :
for x18 in ; do :
for x19 in ; do :
for x20 in ; do :
for x21 in ; do :
for x22 in ; do :
for x23 in ; do :
for x24 in ; do :
for x25 in ; do :
for x26 in ; do :
for x27 in ; do :
for x28 in ; do :
for x29 in ; do :
for x30 in ; do :
for x31 in ; do :
for x32 in ; do :
for x33 in ; do :
for x34 in ; do :
for x35 in ; do :
for x36 in ; do :
for x37 in ; do :
for x38 in ; do :
for x39 in ; do :
for x40 in ; do :
for x41 in ; do :
for x42 in ; do :
for x43 in ; do :
for x44 in ; do :
for x45 in ; do :
for x46 in ; do :
for x47 in ; do :
for x48 in ; do :
for x49 in ; do :
for x50 in ; do :
for x51 in ; do :
for x52 in ; do :
for x53 in ; do :
for x54 in ; do :
for x55 in ; do :
for x56 in ; do :
for x57 in ; do :
for x58 in ; do :
for x59 in ; do :
for x60 in ; do :
for x61 in ; do :
for x62 in ; do :
for x63 in ; do :
for x64 in ; do :
for x65 in ; do :
for x66 in ; do :
for x67 in ; do :
for x68 in ; do :
for x69 in ; do :
for x70 in ; do :
for x71 in ; do :
for x72 in ; do :
for x73 in ; do :
for x74 in ; do :
for x75 in ; do :
for x76 in ; do :
for x77 in ; do :
for x78 in ; do :
for x79 in ; do :
for x80 in ; do :
for x81 in ; do :
for x82 in ; do :
for x83 in ; do :
for x84 in ; do :
for x85 in ; do :
for x86 in ; do :
for x87 in ; do :
for x88 in ; do :
for x89 in ; do :
for x90 in ; do :
for x91 in ; do :
for x92 in ; do :
for x93 in ; do :
for x94 in ; do :
for x95 in ; do :
for x96 in ; do :
for x97 in ; do :
for x98 in ; do :
for x99 in ; do :
for x100 in ; do :
for x101 in ; do :
for x102 in ; do :
for x103 in ; do :
for x104 in ; do :
for x105 in ; do :
for x106 in ; do :
for x107 in ; do :
for x108 in ; do :
for x109 in ; do :
for x110 in ; do :
for x111 in ; do :
for x112 in ; do :
for x113 in ; do :
for x114 in ; do :
for x115 in ; do :
for x116 in ; do :
for x117 in ; do :
for x118 in ; do :
for x119 in ; do :
for x120 in ; do :
for x121 in ; do :
for x122 in ; do :
for x123 in ; do :
for x124 in ; do :
for x125 in ; do :
for x126 in ; do :
for x127 in ; do :
for x128 in ; do :
for x129 in ; do :
for x130 in ; do :
for x131 in ; do :
for x132 in ; do :
for x133 in ; do :
for x134 in ; do :
for x135 in ; do :
for x136 in ; do :
for x137 in ; do :
for x138 in ; do :
for x139 in ; do :
for x140 in ; do :
for x141 in ; do :
for x142 in ; do :
for x143 in ; do :
for x144 in ; do :
for x145 in ; do :
for x146 in ; do :
for x147 in ; do :
for x148 in ; do :
for x149 in ; do :
for x150 in ; do :
for x151 in ; do :
for x152 in ; do :
for x153 in ; do :
for x154 in ; do :
for x155 in ; do :
for x156 in ; do :
for x157 in ; do :
for x158 in ; do :
for x159 in ; do :
for x160 in ; do :
for x161 in ; do :
for x162 in ; do :
for x163 in ; do :
for x164 in ; do :
for x165 in ; do :
for x166 in ; do :
for x167 in ; do :
for x168 in ; do :
for x169 in ; do :
for x170 in ; do :
for x171 in ; do :
for x172 in ; do :
for x173 in ; do :
for x174 in ; do :
for x175 in ; do :
for x176 in ; do :
for x177 in ; do :
for x178 in ; do :
for x179 in ; do :
for x180 in ; do :
for x181 in ; do :
for x182 in ; do :
for x183 in ; do :
for x184 in ; do :
for x185 in ; do :
for x186 in ; do :
for x187 in ; do :
for x188 in ; do :
for x189 in ; do :
for x190 in ; do :
for x191 in ; do :
for x192 in ; do :
for x193 in ; do :
for x194 in ; do :
for x195 in ; do :
for x196 in ; do :
for x197 in ; do :
for x198 in ; do :
for x199 in ; do :
for x200 in ; do :
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
done
tests/exportfunc3.sub
+25
View File
@@ -0,0 +1,25 @@
# test function names that cannot be exported
unset foo # remove from environment if necessary
function foo=bar
{
echo equals-1
}
export -f 'foo=bar'
echo status: $?
foo\=bar
printenv | grep 'foo=bar'
${THIS_SH} -c 'foo\=bar'
function /bin/echo
{
echo bad echo
}
/bin/echo foo
export -f '/bin/echo'
${THIS_SH} -c '/bin/echo bar'
tests/run-exportfunc
+2
View File
@@ -0,0 +1,2 @@
${THIS_SH} ./exportfunc.tests > /tmp/xx 2>&1
diff /tmp/xx exportfunc.right && rm -f /tmp/xx