diff options
| author | Thomas Deutschmann <whissi@gentoo.org> | 2019-08-16 14:38:46 +0200 |
|---|---|---|
| committer | Thomas Deutschmann <whissi@gentoo.org> | 2019-08-16 14:40:22 +0200 |
| commit | b4e5bfd9d4c04c2f942bbecce62e4394d827de16 (patch) | |
| tree | a7a08368e40e218fa62a103ef6d7e43d5f8cc09d /sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch | |
| parent | e11ab933beb45e185e7cf180ec16ddef127e3594 (diff) | |
| download | gentoo-b4e5bfd9d4c04c2f942bbecce62e4394d827de16.tar.gz gentoo-b4e5bfd9d4c04c2f942bbecce62e4394d827de16.tar.bz2 gentoo-b4e5bfd9d4c04c2f942bbecce62e4394d827de16.zip | |
sys-devel/patch: rev bump to add some patches
Bug: https://bugs.gentoo.org/690136
Package-Manager: Portage-2.3.71, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>
Diffstat (limited to 'sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch')
| -rw-r--r-- | sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch b/sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch new file mode 100644 index 000000000000..38caff628aaf --- /dev/null +++ b/sys-devel/patch/files/patch-2.7.6-CVE-2019-13638.patch @@ -0,0 +1,38 @@ +From 3fcd042d26d70856e826a42b5f93dc4854d80bf0 Mon Sep 17 00:00:00 2001 +From: Andreas Gruenbacher <agruen@gnu.org> +Date: Fri, 6 Apr 2018 19:36:15 +0200 +Subject: Invoke ed directly instead of using the shell + +* src/pch.c (do_ed_script): Invoke ed directly instead of using a shell +command to avoid quoting vulnerabilities. +--- + src/pch.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/src/pch.c b/src/pch.c +index 4fd5a05..16e001a 100644 +--- a/src/pch.c ++++ b/src/pch.c +@@ -2459,9 +2459,6 @@ do_ed_script (char const *inname, char const *outname, + *outname_needs_removal = true; + copy_file (inname, outname, 0, exclusive, instat.st_mode, true); + } +- sprintf (buf, "%s %s%s", editor_program, +- verbosity == VERBOSE ? "" : "- ", +- outname); + fflush (stdout); + + pid = fork(); +@@ -2470,7 +2467,8 @@ do_ed_script (char const *inname, char const *outname, + else if (pid == 0) + { + dup2 (tmpfd, 0); +- execl ("/bin/sh", "sh", "-c", buf, (char *) 0); ++ assert (outname[0] != '!' && outname[0] != '-'); ++ execlp (editor_program, editor_program, "-", outname, (char *) NULL); + _exit (2); + } + else +-- +cgit v1.0-41-gc330 + |