utils/bash/patches/135-upstream-bash43-035.patch

   1                              BASH PATCH REPORT
   2                              =================
   3
   4 Bash-Release:   4.3
   5 Patch-ID:       bash43-035
   6
   7 Bug-Reported-by:        <romerox.adrian@gmail.com>
   8 Bug-Reference-ID:       <CABV5r3zhPXmSKUe9uedeGc5YFBM2njJ1iVmY2h5neWdQpDBQug@mail.gmail.com>
   9 Bug-Reference-URL:      http://lists.gnu.org/archive/html/bug-bash/2014-08/msg00045.html
  10
  11 Bug-Description:
  12
  13 A locale with a long name can trigger a buffer overflow and core dump.  This
  14 applies on systems that do not have locale_charset in libc, are not using
  15 GNU libiconv, and are not using the libintl that ships with bash in lib/intl.
  16
  17 Patch (apply with `patch -p0'):
  18
  19 --- a/lib/sh/unicode.c
  20 +++ b/lib/sh/unicode.c
  21 @@ -78,13 +78,15 @@ stub_charset ()
  22    s = strrchr (locale, '.');
  23    if (s)
  24      {
  25 -      strcpy (charsetbuf, s+1);
  26 +      strncpy (charsetbuf, s+1, sizeof (charsetbuf) - 1);
  27 +      charsetbuf[sizeof (charsetbuf) - 1] = '\0';
  28        t = strchr (charsetbuf, '@');
  29        if (t)
  30         *t = 0;
  31        return charsetbuf;
  32      }
  33 -  strcpy (charsetbuf, locale);
  34 +  strncpy (charsetbuf, locale, sizeof (charsetbuf) - 1);
  35 +  charsetbuf[sizeof (charsetbuf) - 1] = '\0';
  36    return charsetbuf;
  37  }
  38  #endif
  39 --- a/patchlevel.h
  40 +++ b/patchlevel.h
  41 @@ -25,6 +25,6 @@
  42     regexp `^#define[   ]*PATCHLEVEL', since that's what support/mkversion.sh
  43     looks for to find the patch level (for the sccs version string). */
  44
  45 -#define PATCHLEVEL 34
  46 +#define PATCHLEVEL 35
  47
  48  #endif /* _PATCHLEVEL_H_ */