<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 8/8/19 4:16 PM, Randy MacLeod wrote:<br>
</div>
<blockquote type="cite"
cite="mid:81291d61-6a10-620c-df84-5b3f066cca0e@windriver.com">On
8/8/19 10:26 AM, Trevor Gamblin wrote:
<br>
<blockquote type="cite">From: Trevor Gamblin
<a class="moz-txt-link-rfc2396E" href="mailto:trevor.gamblin@windriver.com"><trevor.gamblin@windriver.com></a>
<br>
<br>
Signed-off-by: Trevor Gamblin
<a class="moz-txt-link-rfc2396E" href="mailto:trevor.gamblin@windriver.com"><trevor.gamblin@windriver.com></a>
<br>
---
<br>
...ke-ed-directly-instead-of-using-the-shell.patch | 44
++++++++++++++++++++++
<br>
meta/recipes-devtools/patch/patch_2.7.6.bb | 2 +
<br>
2 files changed, 46 insertions(+)
<br>
create mode 100644
meta/recipes-devtools/patch/patch/0001-Invoke-ed-directly-instead-of-using-the-shell.patch<br>
<br>
diff --git
a/meta/recipes-devtools/patch/patch/0001-Invoke-ed-directly-instead-of-using-the-shell.patch
b/meta/recipes-devtools/patch/patch/0001-Invoke-ed-directly-instead-of-using-the-shell.patch
<br>
new file mode 100644
<br>
index 0000000..f60dfe8
<br>
--- /dev/null
<br>
+++
b/meta/recipes-devtools/patch/patch/0001-Invoke-ed-directly-instead-of-using-the-shell.patch<br>
@@ -0,0 +1,44 @@
<br>
+From 3fcd042d26d70856e826a42b5f93dc4854d80bf0 Mon Sep 17
00:00:00 2001
<br>
+From: Andreas Gruenbacher <a class="moz-txt-link-rfc2396E" href="mailto:agruen@gnu.org"><agruen@gnu.org></a>
<br>
+Date: Fri, 6 Apr 2018 19:36:15 +0200
<br>
+Subject: [PATCH] Invoke ed directly instead of using the shell
<br>
+
<br>
+* src/pch.c (do_ed_script): Invoke ed directly instead of using
a shell
<br>
+command to avoid quoting vulnerabilities.
<br>
+
<br>
+CVE: CVE-2019-13638
<br>
+Upstream-Status:
Backport[<a class="moz-txt-link-freetext" href="https://git.savannah.gnu.org/cgit/patch.git/patch/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0">https://git.savannah.gnu.org/cgit/patch.git/patch/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0</a>]<br>
+Signed-off-by: Trevor Gamblin
<a class="moz-txt-link-rfc2396E" href="mailto:trevor.gamblin@windriver.com"><trevor.gamblin@windriver.com></a>
<br>
+
<br>
+---
<br>
+ src/pch.c | 6 ++----
<br>
+ 1 file changed, 2 insertions(+), 4 deletions(-)
<br>
+
<br>
+
<br>
+diff --git a/src/pch.c b/src/pch.c
<br>
+index 4fd5a05..16e001a 100644
<br>
+--- a/src/pch.c
<br>
++++ b/src/pch.c
<br>
+@@ -2459,9 +2459,6 @@ do_ed_script (char const *inname, char
const *outname,
<br>
+ *outname_needs_removal = true;
<br>
+ copy_file (inname, outname, 0, exclusive,
instat.st_mode, true);
<br>
+ }
<br>
+- sprintf (buf, "%s %s%s", editor_program,
<br>
+- verbosity == VERBOSE ? "" : "- ",
<br>
+- outname);
<br>
+ fflush (stdout);
<br>
+
<br>
+ pid = fork();
<br>
+@@ -2470,7 +2467,8 @@ do_ed_script (char const *inname, char
const *outname,
<br>
+ else if (pid == 0)
<br>
+ {
<br>
+ dup2 (tmpfd, 0);
<br>
+- execl ("/bin/sh", "sh", "-c", buf, (char *) 0);
<br>
++ assert (outname[0] != '!' && outname[0] !=
'-');
<br>
++ execlp (editor_program, editor_program, "-", outname,
(char *) NULL);
<br>
+ _exit (2);
<br>
+ }
<br>
+ else
<br>
+--
<br>
+2.7.4
<br>
+
<br>
diff --git a/meta/recipes-devtools/patch/patch_2.7.6.bb
b/meta/recipes-devtools/patch/patch_2.7.6.bb
<br>
index 85b0db7..8908910 100644
<br>
--- a/meta/recipes-devtools/patch/patch_2.7.6.bb
<br>
+++ b/meta/recipes-devtools/patch/patch_2.7.6.bb
<br>
@@ -6,6 +6,8 @@ SRC_URI +=
"<a class="moz-txt-link-freetext" href="file://0001-Unset-need_charset_alias-when-building-for-musl.patch">file://0001-Unset-need_charset_alias-when-building-for-musl.patch</a>
\
<br>
<a class="moz-txt-link-freetext" href="file://0003-Allow-input-files-to-be-missing-for-ed-style-patches.patch">file://0003-Allow-input-files-to-be-missing-for-ed-style-patches.patch</a>
\
<br>
<a class="moz-txt-link-freetext" href="file://0004-Fix-arbitrary-command-execution-in-ed-style-patches-.patch">file://0004-Fix-arbitrary-command-execution-in-ed-style-patches-.patch</a>
\
<br>
<a class="moz-txt-link-freetext" href="file://0001-Fix-swapping-fake-lines-in-pch_swap.patch">file://0001-Fix-swapping-fake-lines-in-pch_swap.patch</a> \
<br>
+ <a class="moz-txt-link-freetext" href="file://CVE-2019-13636.patch">file://CVE-2019-13636.patch</a> \
<br>
+
<a class="moz-txt-link-freetext" href="file://0001-Invoke-ed-directly-instead-of-using-the-shell.patch">file://0001-Invoke-ed-directly-instead-of-using-the-shell.patch</a>
\
<br>
"
<br>
</blockquote>
<br>
Odd, you only added one patch but you changed two lines above.
<br>
I assume this is due to a merge conflict that you incorrectly
resolved.
<br>
<br>
If you apply this commit on warrior, you see:
<br>
<br>
WARNING: patch-2.7.6-r0 do_fetch: Failed to fetch URL
<a class="moz-txt-link-freetext" href="file://CVE-2019-13636.patch">file://CVE-2019-13636.patch</a>, attempting MIRRORS if available
<br>
ERROR: patch-2.7.6-r0 do_fetch: Fetcher failure: Unable to find
file <a class="moz-txt-link-freetext" href="file://CVE-2019-13636.patch">file://CVE-2019-13636.patch</a> anywhere. The paths that were
searched were:
<br>
<br>
Fix and v3 please.
<br>
</blockquote>
<p>Patches are currently under review for both <a
moz-do-not-send="true"
href="https://patchwork.openembedded.org/patch/163490/">warrior</a>
and <a moz-do-not-send="true"
href="https://patchwork.openembedded.org/patch/163495/">thud</a>
to add CVE-2019-13636. Would it be better to hold off on
submitting my patch for CVE-2019-13638 to those branches, until
the line</p>
<p> <a class="moz-txt-link-freetext" href="file://CVE-2019-13636.patch">file://CVE-2019-13636.patch</a> \ <br>
</p>
<p>is incorporated as part of those?<br>
</p>
<blockquote type="cite"
cite="mid:81291d61-6a10-620c-df84-5b3f066cca0e@windriver.com">
<br>
../Randy
<br>
<blockquote type="cite"> SRC_URI[md5sum] =
"4c68cee989d83c87b00a3860bcd05600"
<br>
<br>
</blockquote>
<br>
<br>
</blockquote>
</body>
</html>