mirror of
git://git.code.sf.net/p/cdesktopenv/code
synced 2025-03-09 15:50:02 +00:00
Fix an infinite loop related to $_ if ksh is /bin/sh (#90)
The following explanation is mostly taken from Tomas Klacko's report on the old mailing list (which also contains a C program reproducer) [*]: 1. When ksh starts a binary, it sets its environment variable "_" to "*number*/path/to/binary". Where "number" is the pid of the ksh process. 2. The binary forks and the child executes a suid root shell script which begins with #!/bin/sh. For this bug to occur, ksh must be /bin/sh. 3. The ksh process interpreting the suid shell script leaves the "_" variable as not set (nv_getval(L_ARGNOD) returns NULL) because the "number" from step 1 is not the pid of its parent process. 4-5. Because "_" is not set and the script is suid root, an infinite loop occurs because when the SHELL environment variable contains "/bin/sh" pathshell() returns "/bin/sh". This becomes an infinite loop of /bin/sh /dev/fd/3 executing /bin/sh /dev/fd/3. src/cmd/ksh93/sh/init.c: get_lastarg(): - Disable the check for if the "number" refers to the process id of the parent process. src/cmd/ksh93/sh/main.c: sh_main(): - Prevent an infinite loop when '$_' is not passed in from the environment. Solaris applies this bugfix to their version of ksh: https://github.com/oracle/solaris-userland/blob/master/components/ksh93/patches/190-17432413.patch [*]: https://www.mail-archive.com/ast-developers@lists.research.att.com/msg01680.html
This commit is contained in:
parent
6e515f1d45
commit
8c16f38a88
3 changed files with 4 additions and 2 deletions
2
NEWS
2
NEWS
|
@ -5,6 +5,8 @@ Any uppercase BUG_* names are modernish shell bug IDs.
|
|||
|
||||
2020-07-23:
|
||||
|
||||
- Fixed an infinite loop that could occur when ksh is the system's /bin/sh.
|
||||
|
||||
- A command substitution that is run on the same line as a here-document
|
||||
will no longer cause a syntax error.
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue