1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
Origin: commit c187154f47697cdbf822c2f9d714d570ed4a0fd1
From: Oliver Kiddle <opk@zsh.org>
Date: Wed, 15 Dec 2021 01:56:40 +0100
Subject: [PATCH 1/9] security/41: Don't perform PROMPT_SUBST evaluation on
%F/%K arguments
Mitigates CVE-2021-45444
https://salsa.debian.org/debian/zsh/-/raw/debian/5.8-6+deb11u1/debian/patches/cherry-pick-CVE-2021-45444_1.patch?inline=false
Upstream-Status: Backport
CVE: CVE-2021-45444
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
---
ChangeLog | 5 +++++
Src/prompt.c | 10 ++++++++++
2 files changed, 15 insertions(+)
diff --git a/ChangeLog b/ChangeLog
index 8d7dfc169..eb248ec06 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2022-01-27 dana <dana@dana.is>
+
+ * Oliver Kiddle: security/41: Src/prompt.c: Prevent recursive
+ PROMPT_SUBST
+
2020-02-14 dana <dana@dana.is>
* unposted: Config/version.mk: Update for 5.8
diff --git a/Src/prompt.c b/Src/prompt.c
index b65bfb86b..91e21c8e9 100644
--- a/Src/prompt.c
+++ b/Src/prompt.c
@@ -244,6 +244,12 @@ parsecolorchar(zattr arg, int is_fg)
bv->fm += 2; /* skip over F{ */
if ((ep = strchr(bv->fm, '}'))) {
char oc = *ep, *col, *coll;
+ int ops = opts[PROMPTSUBST], opb = opts[PROMPTBANG];
+ int opp = opts[PROMPTPERCENT];
+
+ opts[PROMPTPERCENT] = 1;
+ opts[PROMPTSUBST] = opts[PROMPTBANG] = 0;
+
*ep = '\0';
/* expand the contents of the argument so you can use
* %v for example */
@@ -252,6 +258,10 @@ parsecolorchar(zattr arg, int is_fg)
arg = match_colour((const char **)&coll, is_fg, 0);
free(col);
bv->fm = ep;
+
+ opts[PROMPTSUBST] = ops;
+ opts[PROMPTBANG] = opb;
+ opts[PROMPTPERCENT] = opp;
} else {
arg = match_colour((const char **)&bv->fm, is_fg, 0);
if (*bv->fm != '}')
--
2.34.1
|
