Re: security fix for 'm4 -F'
Eric Blake <[email protected]>
| Newsgroups | gmane.comp.gnu.m4.patches |
|---|---|
| Message-ID | <[email protected]> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 According to Eric Blake on 11/22/2007 7:39 AM: > $ m4 -F /nosuch/%x </dev/null > m4: /nosuch/0: No such file or directory > > If that doesn't scare you, consider a file name that contains %n. This > security hole has been present since M4 1.3. > It helps if I save the buffer before attaching the file; sorry about the empty file in the last mail. - -- Don't work too hard, make some time for fun as well! Eric Blake [email protected] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Cygwin) Comment: Public key at home.comcast.net/~ericblake/eblake.gpg Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFHRZsA84KuGfSFAYARAmfzAKCrdgJToAVmQ1XxvH4aXVkmNC2VPQCeIM/L Qfp/j84K9DQq4q3JWMm6NVk= =2edr -----END PGP SIGNATURE----- _______________________________________________ M4-patches mailing list [email protected] http://lists.gnu.org/mailman/listinfo/m4-patches
m4.patch294
(text/plain, 1.9 KB)
From 031a71a80442ed2ad3c2ee14d5811c786a12c51b Mon Sep 17 00:00:00 2001 From: Eric Blake <[email protected]> Date: Thu, 22 Nov 2007 07:34:32 -0700 Subject: [PATCH] Security fix: avoid arbitrary code execution with 'm4 -F'. * src/freeze.c (produce_frozen_state): Never pass raw file name as printf format. * NEWS: Document this fix. Signed-off-by: Eric Blake <[email protected]> --- ChangeLog | 7 +++++++ NEWS | 5 +++-- src/freeze.c | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 4179e81..4d8ec23 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2007-11-22 Eric Blake <[email protected]> + + Security fix: avoid arbitrary code execution with 'm4 -F'. + * src/freeze.c (produce_frozen_state): Never pass raw file name as + printf format. + * NEWS: Document this fix. + 2007-11-21 Eric Blake <[email protected]> Consistently report macro name first in messages. diff --git a/NEWS b/NEWS index d988adf..1762571 100644 --- a/NEWS +++ b/NEWS @@ -4,8 +4,9 @@ Foundation, Inc. Version 1.4.11 - ?? ??? 2007, by ???? (git version 1.4.10a-*) -* Fix core dump in 'm4 -F file -t undefined', present since -F was - introduced in 1.3. +* Security fixes for the -F option, for bugs present since -F was + introduced in 1.3: Avoid core dump with 'm4 -F file -t undefined', and + avoid arbitrary code execution with certain file names. * Fix regression introduced in 1.4.9b in the `divert' builtin when more than 512 kibibytes are saved in diversions on platforms like NetBSD where fopen(name,"a+") seeks to the end of the file. diff --git a/src/freeze.c b/src/freeze.c index 2858e64..df68f3a 100644 --- a/src/freeze.c +++ b/src/freeze.c @@ -58,7 +58,7 @@ produce_frozen_state (const char *name) if (file = fopen (name, O_BINARY ? "wb" : "w"), !file) { - M4ERROR ((warning_status, errno, name)); + M4ERROR ((warning_status, errno, "%s", name)); return; } -- 1.5.3.5