[arch-commits] Commit in perl/trunk (CVE-2016-2381_duplicate_env.diff PKGBUILD)
Florian Pritz
bluewind at archlinux.org
Mon Mar 7 18:48:04 UTC 2016
Date: Monday, March 7, 2016 @ 19:48:04
Author: bluewind
Revision: 261176
FS#48482 - [perl] CVE-2016-2381 - bug in 'taint' environment handling
upgpkg: perl 5.22.1-2
Added:
perl/trunk/CVE-2016-2381_duplicate_env.diff
Modified:
perl/trunk/PKGBUILD
----------------------------------+
CVE-2016-2381_duplicate_env.diff | 104 +++++++++++++++++++++++++++++++++++++
PKGBUILD | 10 +++
2 files changed, 113 insertions(+), 1 deletion(-)
Added: CVE-2016-2381_duplicate_env.diff
===================================================================
--- CVE-2016-2381_duplicate_env.diff (rev 0)
+++ CVE-2016-2381_duplicate_env.diff 2016-03-07 18:48:04 UTC (rev 261176)
@@ -0,0 +1,104 @@
+From 83e7ebed7afa79a2f50eca6b6330eae7c3a02d36 Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony at develop-help.com>
+Date: Wed, 27 Jan 2016 11:52:15 +1100
+Subject: remove duplicate environment variables from environ
+
+If we see duplicate environment variables while iterating over
+environ[]:
+
+a) make sure we use the same value in %ENV that getenv() returns.
+
+Previously on a duplicate, %ENV would have the last entry for the name
+from environ[], but a typical getenv() would return the first entry.
+
+Rather than assuming all getenv() implementations return the first entry
+explicitly call getenv() to ensure they agree.
+
+b) remove duplicate entries from environ
+
+Previously if there was a duplicate definition for a name in environ[]
+setting that name in %ENV could result in an unsafe value being passed
+to a child process, so ensure environ[] has no duplicates.
+
+Patch-Name: fixes/CVE-2016-2381_duplicate_env.diff
+---
+ perl.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 49 insertions(+), 2 deletions(-)
+
+diff --git a/perl.c b/perl.c
+index 80a76c2..ed25429 100644
+--- a/perl.c
++++ b/perl.c
+@@ -4303,23 +4303,70 @@ S_init_postdump_symbols(pTHX_ int argc, char **argv, char **env)
+ }
+ if (env) {
+ char *s, *old_var;
++ STRLEN nlen;
+ SV *sv;
++ HV *dups = newHV();
++
+ for (; *env; env++) {
+ old_var = *env;
+
+ if (!(s = strchr(old_var,'=')) || s == old_var)
+ continue;
++ nlen = s - old_var;
+
+ #if defined(MSDOS) && !defined(DJGPP)
+ *s = '\0';
+ (void)strupr(old_var);
+ *s = '=';
+ #endif
+- sv = newSVpv(s+1, 0);
+- (void)hv_store(hv, old_var, s - old_var, sv, 0);
++ if (hv_exists(hv, old_var, nlen)) {
++ const char *name = savepvn(old_var, nlen);
++
++ /* make sure we use the same value as getenv(), otherwise code that
++ uses getenv() (like setlocale()) might see a different value to %ENV
++ */
++ sv = newSVpv(PerlEnv_getenv(name), 0);
++
++ /* keep a count of the dups of this name so we can de-dup environ later */
++ if (hv_exists(dups, name, nlen))
++ ++SvIVX(*hv_fetch(dups, name, nlen, 0));
++ else
++ (void)hv_store(dups, name, nlen, newSViv(1), 0);
++
++ Safefree(name);
++ }
++ else {
++ sv = newSVpv(s+1, 0);
++ }
++ (void)hv_store(hv, old_var, nlen, sv, 0);
+ if (env_is_not_environ)
+ mg_set(sv);
+ }
++ if (HvKEYS(dups)) {
++ /* environ has some duplicate definitions, remove them */
++ HE *entry;
++ hv_iterinit(dups);
++ while ((entry = hv_iternext_flags(dups, 0))) {
++ STRLEN nlen;
++ const char *name = HePV(entry, nlen);
++ IV count = SvIV(HeVAL(entry));
++ IV i;
++ SV **valp = hv_fetch(hv, name, nlen, 0);
++
++ assert(valp);
++
++ /* try to remove any duplicate names, depending on the
++ * implementation used in my_setenv() the iteration might
++ * not be necessary, but let's be safe.
++ */
++ for (i = 0; i < count; ++i)
++ my_setenv(name, 0);
++
++ /* and set it back to the value we set $ENV{name} to */
++ my_setenv(name, SvPV_nolen(*valp));
++ }
++ }
++ SvREFCNT_dec_NN(dups);
+ }
+ #endif /* USE_ENVIRON_ARRAY */
+ #endif /* !PERL_MICRO */
Modified: PKGBUILD
===================================================================
--- PKGBUILD 2016-03-07 16:06:23 UTC (rev 261175)
+++ PKGBUILD 2016-03-07 18:48:04 UTC (rev 261176)
@@ -7,7 +7,7 @@
pkgname=perl
pkgver=5.22.1
-pkgrel=1
+pkgrel=2
pkgdesc="A highly capable, feature-rich programming language"
arch=(i686 x86_64)
license=('GPL' 'PerlArtistic')
@@ -135,15 +135,23 @@
# Add your own provides here
provides=(${provides[@]})
source=(http://www.cpan.org/src/5.0/perl-${pkgver}.tar.bz2
+ CVE-2016-2381_duplicate_env.diff
perlbin.sh
perlbin.csh
perl-binary-module-dependency-1.template)
options=('makeflags' '!purge' 'emptydirs')
md5sums=('67242b9bd642b458bec884ed2a040910'
+ 'a108f258b9ba1504b6051d123ccaa623'
'5ed2542fdb9a60682f215bd33701e61a'
'1f0cbbee783e8a6d32f01be5118e0d5e'
'2a366dfc783c460764cde0caf88a23af')
+prepare() {
+ cd ${srcdir}/${pkgname}-${pkgver}
+
+ patch -p1 -i "$srcdir/CVE-2016-2381_duplicate_env.diff"
+}
+
build() {
cd ${srcdir}/${pkgname}-${pkgver}
More information about the arch-commits
mailing list