patchThe GNU Bourne-Again SHell - Patches: patch #10035, fix regression in 5.1: 1-byte...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #10035: fix regression in 5.1: 1-byte buffer overflow read in subst.c read_comsub

Submitter:  Platon Pronko <rogach>
Submitted:  Mon 01 Mar 2021 05:15:14 PM UTC
Votes: 20
 
Category:  None Priority:  5 - Normal
Status:  Done Privacy:  Public
Assigned to:  None Open/Closed:  Open

Jump to the original submission

Fri 04 Feb 2022 11:32:10 AM UTC, comment #6: 

I think this is already merged, and released as a patch to 5.1 version: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-014

So I suspect that the ball is in Debian's court now.

Platon Pronko <rogach>
Fri 04 Feb 2022 11:22:41 AM UTC, comment #5: 

I've tested this patch on two productive systems for a long while without any problems.

What has to be done to get this merged? Is there something I can do? As said, this is a huge blocker to upgrading to Debian stable right now.

Max Mehl <mxmehl>
Fri 22 Oct 2021 02:40:23 PM UTC, comment #4: 

comment #3:

> Just tested on my Arch Linux, with bash package version 5.1.008-1, and the reproducer works for me. Maybe you have some different locale settings?


Yes, that seems to be it.

`LC_ALL=en_GB.UTF-8 ./reproducer.sh` does not fail, while `LC_ALL=C ...` does.

Max Mehl <mxmehl>
Fri 22 Oct 2021 12:45:55 PM UTC, comment #3: 


> Interestingly, the reproducer did not throw the expected error on my recent Arch Linux installation


Just tested on my Arch Linux, with bash package version 5.1.008-1, and the reproducer works for me. Maybe you have some different locale settings?

Platon Pronko <rogach>
Fri 22 Oct 2021 11:44:07 AM UTC, comment #2: 

original submission:

> I'm attaching a patch for your consideration - it's simply replacing `bufn+1` with `bufn`, eliminating out-of-bounds read and resulting in correct non-corrupted output.


Thank you for the patch! I can confirm it solves this issue.

Interestingly, the reproducer did not throw the expected error on my recent Arch Linux installation, but it did solve an issue we've been having with building the FSFE website.

It would be great if this patch could be merged so downstream users can benefit from this solved problem.

Max Mehl <mxmehl>
Mon 01 Mar 2021 09:50:40 PM UTC, comment #1: 

Thanks for the report.

Chet Ramey <chet>
Group administrator
Mon 01 Mar 2021 05:15:14 PM UTC, original submission:  

read_comsub() calls mbrtowc() with bufn+1, which allows 1-byte out-of-bounds read if multibyte character happens to start exactly one byte before the buffer end.

The bug can be reliably reproduced on latest master and develop branches. I've attached reproducer.sh script and input.txt (used from the script).
When bug is triggered, "iconv: illegal input sequence at position 513" error message is printed - even though input.txt itself is quite valid utf.

I'm attaching a patch for your consideration - it's simply replacing `bufn+1` with `bufn`, eliminating out-of-bounds read and resulting in correct non-corrupted output.

Platon Pronko <rogach>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #50956:  subst.patch added by rogach (479B - text/x-patch)
file #50957:  reproducer.sh added by rogach (234B - application/x-shellscript)
file #50958:  input.txt added by rogach (514B - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mxmehl (Posted a comment)
  • -email is unavailable- added by mxmehl (Voted in favor of this item)
  • -email is unavailable- added by chet (Posted a comment)
  • -email is unavailable- added by rogach (Submitted the item)
  •  

    There are 20 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-10-22 mxmehl Carbon-Copy- Added mxmehl
    2021-03-01 chet StatusNone Done
    2021-03-01 rogach Attached File- Added subst.patch, #50956
        Attached File- Added reproducer.sh, #50957
        Attached File- Added input.txt, #50958

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code