summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorThomas Deutschmann <whissi@gentoo.org>2019-08-16 14:38:46 +0200
committerThomas Deutschmann <whissi@gentoo.org>2019-08-16 14:40:22 +0200
commitb4e5bfd9d4c04c2f942bbecce62e4394d827de16 (patch)
treea7a08368e40e218fa62a103ef6d7e43d5f8cc09d /sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch
parentwww-client/opera-beta: Old (diff)
downloadgentoo-b4e5bfd9d4c04c2f942bbecce62e4394d827de16.tar.gz
gentoo-b4e5bfd9d4c04c2f942bbecce62e4394d827de16.tar.bz2
gentoo-b4e5bfd9d4c04c2f942bbecce62e4394d827de16.zip
sys-devel/patch: rev bump to add some patches
Bug: https://bugs.gentoo.org/690136 Package-Manager: Portage-2.3.71, Repoman-2.3.17 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>
Diffstat (limited to 'sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch')
-rw-r--r--sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch38
1 files changed, 38 insertions, 0 deletions
diff --git a/sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch b/sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch
new file mode 100644
index 00000000000..38caff628aa
--- /dev/null
+++ b/sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch
@@ -0,0 +1,38 @@
+From 3fcd042d26d70856e826a42b5f93dc4854d80bf0 Mon Sep 17 00:00:00 2001
+From: Andreas Gruenbacher <agruen@gnu.org>
+Date: Fri, 6 Apr 2018 19:36:15 +0200
+Subject: Invoke ed directly instead of using the shell
+
+* src/pch.c (do_ed_script): Invoke ed directly instead of using a shell
+command to avoid quoting vulnerabilities.
+---
+ src/pch.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/src/pch.c b/src/pch.c
+index 4fd5a05..16e001a 100644
+--- a/src/pch.c
++++ b/src/pch.c
+@@ -2459,9 +2459,6 @@ do_ed_script (char const *inname, char const *outname,
+ *outname_needs_removal = true;
+ copy_file (inname, outname, 0, exclusive, instat.st_mode, true);
+ }
+- sprintf (buf, "%s %s%s", editor_program,
+- verbosity == VERBOSE ? "" : "- ",
+- outname);
+ fflush (stdout);
+
+ pid = fork();
+@@ -2470,7 +2467,8 @@ do_ed_script (char const *inname, char const *outname,
+ else if (pid == 0)
+ {
+ dup2 (tmpfd, 0);
+- execl ("/bin/sh", "sh", "-c", buf, (char *) 0);
++ assert (outname[0] != '!' && outname[0] != '-');
++ execlp (editor_program, editor_program, "-", outname, (char *) NULL);
+ _exit (2);
+ }
+ else
+--
+cgit v1.0-41-gc330
+