From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 15104 invoked from network); 22 May 2020 18:57:15 -0000 Received: from ns1.primenet.com.au (HELO primenet.com.au) (203.24.36.2) by inbox.vuxu.org with ESMTPUTF8; 22 May 2020 18:57:15 -0000 Received: (qmail 17596 invoked by alias); 22 May 2020 18:57:08 -0000 Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm Precedence: bulk X-No-Archive: yes List-Id: Zsh Workers List List-Post: List-Help: List-Unsubscribe: X-Seq: 45894 Received: (qmail 28708 invoked by uid 1010); 22 May 2020 18:57:08 -0000 X-Qmail-Scanner-Diagnostics: from know-smtprelay-omc-10.server.virginmedia.net by f.primenet.com.au (envelope-from , uid 7791) with qmail-scanner-2.11 (clamdscan: 0.102.3/25814. spamassassin: 3.4.4. Clear:RC:0(80.0.253.74):SA:0(-2.0/5.0):. Processed in 3.067328 secs); 22 May 2020 18:57:08 -0000 X-Envelope-From: p.w.stephenson@ntlworld.com X-Qmail-Scanner-Mime-Attachments: | X-Qmail-Scanner-Zip-Files: | Received-SPF: pass (ns1.primenet.com.au: SPF record at _smtprelay.virginmedia.com designates 80.0.253.74 as permitted sender) X-Originating-IP: [86.16.88.158] X-Authenticated-User: p.w.stephenson@ntlworld.com X-Spam: 0 X-Authority: v=2.3 cv=YvshubQX c=1 sm=1 tr=0 a=MiHCjVqLJ44lE3bxSlffFQ==:117 a=MiHCjVqLJ44lE3bxSlffFQ==:17 a=IkcTkHD0fZMA:10 a=npldXguGAAAA:8 a=waUAQboyEyH9mroBug0A:9 a=QEXdDO2ut3YA:10 a=1Z6EAcxPEhoA:10 a=Y6yEfkeh0FwA:10 a=1MEZn5qd6kv58cYvHi58:22 Message-ID: Subject: Re: [BUG] Two vulnerabilities in zsh From: Peter Stephenson To: zsh-workers@zsh.org Date: Fri, 22 May 2020 19:56:24 +0100 In-Reply-To: <20200520004509.741352d3@tarpaulin.shahaf.local2> References: <20200519170418.5bc00b2f@tarpaulin.shahaf.local2> <20200520004509.741352d3@tarpaulin.shahaf.local2> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.28.5-0ubuntu0.18.04.2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfFEbVvwEqKFegtZHbYMb8Ut3Gcx85nOkOsCjEejC8jwlpeR5jEmZef7uXuG+R8NOBXZt1k6rshmmum1wloS2Pt1awP1PBHIGYc/l32fv2S8P8AsJxW7k eK4bjGhy+Kd2QRj630gvrJWnQ/eTjRnH1mrWkGaiBUnQYhT0GKpsG0iS On Wed, 2020-05-20 at 00:45 +0000, Daniel Shahaf wrote: > Peter Stephenson wrote on Tue, 19 May 2020 21:38 +0100: > > The BUG message simplifies to this: > > > > (127)9:32% zsh -fc '$\ > > (' > > 1: BUG: parse error in command substitution > > zsh:1: no such file or directory: pws/. > > > > The other output shows it's doing something it shouldn't even if there > > isn't a crash as a result. Adding a command in front does produce a > > crash. > > > > I think the backslashed newline is valid, and it looks like it's usually > > correctly handled; apparently its presence is disguising the bad input > > in this case. > > Test cases: This seems to be doing the right thing. It's a bit hairy, but I think it just *is* a bit hairy --- we do need to re-input the multi-character special sequence if there's something to ignore in the middle. I can't see an obvious problem with how I've done it as it can't be triggered by anythign else that I can see. There may be other sequences like this. I believe inlined patches work from this version of Evolution... pws diff --git a/Src/lex.c b/Src/lex.c index a541defe6..5382a5309 100644 --- a/Src/lex.c +++ b/Src/lex.c @@ -1237,6 +1237,19 @@ gettokstr(int c, int sub) case LX2_BKSLASH: c = hgetc(); if (c == '\n') { + if (lexbuf.len && !lexstop && + (lexbuf.ptr[-1] == String || + lexbuf.ptr[-1] == Qstring)) + { + /* + * $-prefixed expression interrupted by \\\n. + * This is valid --- reparse. + */ + --lexbuf.len; + --lexbuf.ptr; + c = '$'; + continue; + } c = hgetc(); if (!lexstop) continue; diff --git a/Test/D04parameter.ztst b/Test/D04parameter.ztst index 6d2dd0d99..a3661f5da 100644 --- a/Test/D04parameter.ztst +++ b/Test/D04parameter.ztst @@ -2662,7 +2662,6 @@ F:behavior, see http://austingroupbugs.net/view.php?id=888 -f:regression test for workers/45843#1 ?(eval):1: bad substitution -# Temporarily using the 'D' flag because it generates a "BUG:" message in -# debug builds only. $ZTST_testdir/../Src/zsh -fc $'$\\\n(' -1Df:regression test for workers/45843#2: escaped newline in command substitution start token +1f:regression test for workers/45843#2: escaped newline in command substitution start token +?(eval):1: parse error near `$('