lang/perl/patches/901-CVE-2016-2381.patch

   1 From: Tony Cook <tony@develop-help.com>
   2 Date: Wed, 27 Jan 2016 00:52:15 +0000 (+1100)
   3 Subject: remove duplicate environment variables from environ
   4 X-Git-Url: http://perl5.git.perl.org/perl.git/commitdiff_plain/ae37b791a73a9e78dedb89fb2429d2628cf58076
   5
   6 remove duplicate environment variables from environ
   7
   8 If we see duplicate environment variables while iterating over
   9 environ[]:
  10
  11 a) make sure we use the same value in %ENV that getenv() returns.
  12
  13 Previously on a duplicate, %ENV would have the last entry for the name
  14 from environ[], but a typical getenv() would return the first entry.
  15
  16 Rather than assuming all getenv() implementations return the first entry
  17 explicitly call getenv() to ensure they agree.
  18
  19 b) remove duplicate entries from environ
  20
  21 Previously if there was a duplicate definition for a name in environ[]
  22 setting that name in %ENV could result in an unsafe value being passed
  23 to a child process, so ensure environ[] has no duplicates.
  24
  25 CVE-2016-2381
  26 ---
  27
  28 --- a/perl.c
  29 +++ b/perl.c
  30 @@ -4298,23 +4298,70 @@ S_init_postdump_symbols(pTHX_ int argc,
  31         }
  32         if (env) {
  33           char *s, *old_var;
  34 +          STRLEN nlen;
  35           SV *sv;
  36 +          HV *dups = newHV();
  37 +
  38           for (; *env; env++) {
  39             old_var = *env;
  40
  41             if (!(s = strchr(old_var,'=')) || s == old_var)
  42                 continue;
  43 +            nlen = s - old_var;
  44
  45  #if defined(MSDOS) && !defined(DJGPP)
  46             *s = '\0';
  47             (void)strupr(old_var);
  48             *s = '=';
  49  #endif
  50 -           sv = newSVpv(s+1, 0);
  51 -           (void)hv_store(hv, old_var, s - old_var, sv, 0);
  52 +            if (hv_exists(hv, old_var, nlen)) {
  53 +                const char *name = savepvn(old_var, nlen);
  54 +
  55 +                /* make sure we use the same value as getenv(), otherwise code that
  56 +                   uses getenv() (like setlocale()) might see a different value to %ENV
  57 +                 */
  58 +                sv = newSVpv(PerlEnv_getenv(name), 0);
  59 +
  60 +                /* keep a count of the dups of this name so we can de-dup environ later */
  61 +                if (hv_exists(dups, name, nlen))
  62 +                    ++SvIVX(*hv_fetch(dups, name, nlen, 0));
  63 +                else
  64 +                    (void)hv_store(dups, name, nlen, newSViv(1), 0);
  65 +
  66 +                Safefree(name);
  67 +            }
  68 +            else {
  69 +                sv = newSVpv(s+1, 0);
  70 +            }
  71 +           (void)hv_store(hv, old_var, nlen, sv, 0);
  72             if (env_is_not_environ)
  73                 mg_set(sv);
  74           }
  75 +          if (HvKEYS(dups)) {
  76 +              /* environ has some duplicate definitions, remove them */
  77 +              HE *entry;
  78 +              hv_iterinit(dups);
  79 +              while ((entry = hv_iternext_flags(dups, 0))) {
  80 +                  STRLEN nlen;
  81 +                  const char *name = HePV(entry, nlen);
  82 +                  IV count = SvIV(HeVAL(entry));
  83 +                  IV i;
  84 +                  SV **valp = hv_fetch(hv, name, nlen, 0);
  85 +
  86 +                  assert(valp);
  87 +
  88 +                  /* try to remove any duplicate names, depending on the
  89 +                   * implementation used in my_setenv() the iteration might
  90 +                   * not be necessary, but let's be safe.
  91 +                   */
  92 +                  for (i = 0; i < count; ++i)
  93 +                      my_setenv(name, 0);
  94 +
  95 +                  /* and set it back to the value we set $ENV{name} to */
  96 +                  my_setenv(name, SvPV_nolen(*valp));
  97 +              }
  98 +          }
  99 +          SvREFCNT_dec_NN(dups);
 100        }
 101  #endif /* USE_ENVIRON_ARRAY */
 102  #endif /* !PERL_MICRO */