Re: Bash-4.3 Official Patch 25

[mark]

On Friday, September 26, 2014 9:58:56 AM UTC+10, Chet Ramey wrote:
> On 9/24/14, 5:38 PM, Eric Blake wrote:
> 
> 
> 
> > and I'd feel much more comfortable with exporting f()=... as the
> 
> > backdoor for passing the function definition, _particularly_ since the
> 
> > shell already allows functions and variables to co-exist:
> 
> 
> 
> We used to do that, and part of the code that I removed in patch 25
> 
> supported the original `name()=() {'.  We didn't use that very long; it
> 
> turns out that the Bourne shell (and others, at that time) dumps core on
> 
> malformed environment variable names.  It's why we stuck with shell
> 
> identifiers, though the check for that didn't come in until later.
> 
> 
> 
> I'd be willing to bet that the Bourne shell that still runs on Solaris,
> 
> AIX, HP-UX, and SCO (if anyone still runs that) has this problem.
> 
> -- 
> 
> ``The lyf so short, the craft so long to lerne.'' - Chaucer
> 
>                ``Ars longa, vita brevis'' - Hippocrates
> 
> Chet Ramey, ITS, CWRU    address@hidden    http://cnswww.cns.cwru.edu/~chet/


Not these Solaris ones :)


env x='() { :;}; echo vulnerable'  /usr/local/bin/bash -c "echo this is a test"
/usr/local/bin/bash: warning: x: ignoring function definition attempt
/usr/local/bin/bash: error importing function definition for `x'
this is a test

bash-4.3# (X='() { (a)=>\' bash -c "echo ls /etc; cat echo")
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
ls /etc
cat: cannot open echo

I've just issued the new Solaris packages on the archive.

http://www.ibiblio.org/pub/packages/solaris/sparc/

-rw-------    1 mark users 7463936 Sep 26 00:06 
bash.4.3.p026.SPARC.32bit.Solaris.10.pkg
-rw-------    1 mark users 7745024 Sep 26 00:06 
bash.4.3.p026.SPARC.32bit.Solaris.8.pkg
-rw-------    1 mark users 7750144 Sep 26 00:06 
bash.4.3.p026.SPARC.32bit.Solaris.9.pkg
-rw-------    1 mark users 7765504 Sep 26 00:06 
bash.4.3.p026.SPARC.64bit.Solaris.10.pkg
-rw-------    1 mark users 7968768 Sep 26 00:07 
bash.4.3.p026.SPARC.64bit.Solaris.11.pkg
-rw-------    1 mark users 8154112 Sep 26 00:07 
bash.4.3.p026.SPARC.64bit.Solaris.8.pkg
-rw-------    1 mark users 8147456 Sep 26 00:07 
bash.4.3.p026.SPARC.64bit.Solaris.9.pkg
-rw-------    1 mark users 7868416 Sep 26 00:07 
bash.4.3.p026.i86pc.64bit.Solaris.11.pkg
-rw-------    1 mark users 7700992 Sep 26 00:07 
bash.4.3.p026.i86pc.Solaris.10.pkg
-rw-------    1 mark users 7426560 Sep 26 00:07 
bash.4.3.p026.i86pc.Solaris.11.pkg

-rw-------    1 mark users 1685504 Sep 26 00:06 
readline.6.3.SPARC.32bit.Solaris.10.pkg
-rw-------    1 mark users 1706496 Sep 26 00:06 
readline.6.3.SPARC.32bit.Solaris.8.pkg
-rw-------    1 mark users 1715200 Sep 26 00:06 
readline.6.3.SPARC.32bit.Solaris.9.pkg
-rw-------    1 mark users 2161152 Sep 26 00:06 
readline.6.3.SPARC.64bit.Solaris.10.pkg
-rw-------    1 mark users 2287104 Sep 26 00:06 
readline.6.3.SPARC.64bit.Solaris.11.pkg
-rw-------    1 mark users 2199552 Sep 26 00:06 
readline.6.3.SPARC.64bit.Solaris.8.pkg
-rw-------    1 mark users 2196992 Sep 26 00:06 
readline.6.3.SPARC.64bit.Solaris.9.pkg
-rw-------    1 mark users 3524608 Sep 26 00:06 
readline.6.3.i86pc.64bit.Solaris.11.pkg
-rw-------    1 mark users 1645056 Sep 26 00:06 
readline.6.3.i86pc.Solaris.10.pkg
-rw-------    1 mark users 1554432 Sep 26 00:06 
readline.6.3.i86pc.Solaris.11.pkg