From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 27967 invoked from network); 20 May 2020 00:45:53 -0000 Received: from ns1.primenet.com.au (HELO primenet.com.au) (203.24.36.2) by inbox.vuxu.org with ESMTPUTF8; 20 May 2020 00:45:53 -0000 Received: (qmail 19251 invoked by alias); 20 May 2020 00:45:47 -0000 Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm Precedence: bulk X-No-Archive: yes List-Id: Zsh Workers List List-Post: List-Help: List-Unsubscribe: X-Seq: 45862 Received: (qmail 17444 invoked by uid 1010); 20 May 2020 00:45:47 -0000 X-Qmail-Scanner-Diagnostics: from wout2-smtp.messagingengine.com by f.primenet.com.au (envelope-from , uid 7791) with qmail-scanner-2.11 (clamdscan: 0.102.3/25814. spamassassin: 3.4.4. Clear:RC:0(64.147.123.25):SA:0(-2.6/5.0):. Processed in 1.278973 secs); 20 May 2020 00:45:47 -0000 X-Envelope-From: d.s@daniel.shahaf.name X-Qmail-Scanner-Mime-Attachments: | X-Qmail-Scanner-Zip-Files: | Received-SPF: none (ns1.primenet.com.au: domain at daniel.shahaf.name does not designate permitted sender hosts) X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduhedruddtkedgfeejucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpeffhffvuffkjghfofggtgfgsehtqh dttdertdejnecuhfhrohhmpeffrghnihgvlhcuufhhrghhrghfuceougdrshesuggrnhhi vghlrdhshhgrhhgrfhdrnhgrmhgvqeenucggtffrrghtthgvrhhnpedtudfhkefggfeggf evieeiheehkeethfdugeeugeeukeeifeevkeekhfeuvddtgfenucffohhmrghinheprghu shhtihhnghhrohhuphgsuhhgshdrnhgvthenucfkphepjeelrddujeejrddufeegrdefne cuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhepugdrshes uggrnhhivghlrdhshhgrhhgrfhdrnhgrmhgv X-ME-Proxy: Date: Wed, 20 May 2020 00:45:09 +0000 From: Daniel Shahaf To: zsh-workers@zsh.org Cc: Aaron Esau Subject: Re: [BUG] Two vulnerabilities in zsh Message-ID: <20200520004509.741352d3@tarpaulin.shahaf.local2> In-Reply-To: References: <20200519170418.5bc00b2f@tarpaulin.shahaf.local2> X-Mailer: Claws Mail 3.17.3 (GTK+ 2.24.32; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Peter Stephenson wrote on Tue, 19 May 2020 21:38 +0100: > On Tue, 2020-05-19 at 17:04 +0000, Daniel Shahaf wrote: > > > 1. Execute the following PoC command: > > >=20 > > > echo $'******** **********************$\\\n(>$' | zsh =20 > >=20 > > This instruction is underspecified because it does not identify =C2=ABe= cho=C2=BB > > implementation being used and the shell being used (which affects how > > the =C2=AB$'=E2=80=A6'=C2=BB would be parsed). That aside, I can repro= duce this: > >=20 > > $ printf '******** **********************$\\\n(>$' | zsh -f=20 > > BUG: parse error in command substitution > > Segmentation fault > > $ =20 >=20 > The BUG message simplifies to this: >=20 > (127)9:32% zsh -fc '$\ > (' > 1: BUG: parse error in command substitution > zsh:1: no such file or directory: pws/. >=20 > The other output shows it's doing something it shouldn't even if there > isn't a crash as a result. Adding a command in front does produce a > crash. >=20 > I think the backslashed newline is valid, and it looks like it's usually > correctly handled; apparently its presence is disguising the bad input > in this case. Test cases: diff --git a/Test/D04parameter.ztst b/Test/D04parameter.ztst index 024de4d2b..6d2dd0d99 100644 --- a/Test/D04parameter.ztst +++ b/Test/D04parameter.ztst @@ -2656,3 +2656,13 @@ F:behavior, see http://austingroupbugs.net/view.php?= id=3D888 >1: pws >3: pw >4: pw + + # Using a subshell because it segfaults. + ("${: :${{{\"{{lorem ipsum dolor sit amet}}") +-f:regression test for workers/45843#1 +?(eval):1: bad substitution + +# Temporarily using the 'D' flag because it generates a "BUG:" message in +# debug builds only. + $ZTST_testdir/../Src/zsh -fc $'$\\\n(' +1Df:regression test for workers/45843#2: escaped newline in command substi= tution start token I haven't added the crashing version of 45843#2. Let me know if I should. Cheers, Daniel