buildroot
Public
Source
committed 47df048f8d1xxxxxxxxxx! return (bind_variable_internal (nameref_cell (nv), value, nvc->table, 0, flags|ASS_FROMREF));From http://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-031Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> BASH PATCH REPORT =================Bash-Release: 4.3Patch-ID: bash43-031Bug-Reported-by: lolilolicon <lolilolicon@gmail.com>Bug-Reference-ID: <CAMtVo_Nz=32Oq=zWTb6=+8gUNXOo2rRvud1W4oPnA-cgVk_ZqQ@mail.gmail.com>Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2014-08/msg00139.htmlBug-Description:The new nameref assignment functionality introduced in bash-4.3 did not performenough validation on the variable value and would create variables withinvalid names.Patch (apply with `patch -p0'):*** a/bash-4.3-patched/subst.h 2014-01-11 21:02:27.000000000 -0500--- b/subst.h 2014-09-01 12:16:56.000000000 -0400****************** 48,51 ****--- 48,52 ---- #define ASS_MKGLOBAL 0x0008 /* force global assignment */ #define ASS_NAMEREF 0x0010 /* assigning to nameref variable */+ #define ASS_FROMREF 0x0020 /* assigning from value of nameref variable */ /* Flags for the string extraction functions. */*** a/bash-4.3-patched/variables.c 2014-05-15 08:26:50.000000000 -0400--- b/variables.c 2014-09-01 14:37:44.000000000 -0400****************** 2504,2511 **** int hflags, aflags; {! char *newval; SHELL_VAR *entry; entry = (hflags & HASH_NOSRCH) ? (SHELL_VAR *)NULL : hash_lookup (name, table); /* Follow the nameref chain here if this is the global variables table */ if (entry && nameref_p (entry) && (invisible_p (entry) == 0) && table == global_variables->table)--- 2566,2590 ---- int hflags, aflags; {! char *newname, *newval; SHELL_VAR *entry;+ #if defined (ARRAY_VARS)+ arrayind_t ind;+ char *subp;+ int sublen;+ #endif+ newname = 0;+ #if defined (ARRAY_VARS)+ if ((aflags & ASS_FROMREF) && (hflags & HASH_NOSRCH) == 0 && valid_array_reference (name))+ {+ newname = array_variable_name (name, &subp, &sublen);+ if (newname == 0)+ return (SHELL_VAR *)NULL; /* XXX */+ entry = hash_lookup (newname, table);