gentoo resync : 10.02.2020

3 files changed, 93 insertions, 2 deletions

diff --git a/app-shells/ksh/Manifest b/app-shells/ksh/Manifest
index 8b775bc28c1d..69c06c4e0daf 100644
--- a/app-shells/ksh/Manifest
+++ b/app-shells/ksh/Manifest
@@ -1,6 +1,7 @@
+AUX CVE-2019-14868.patch 3746 BLAKE2B 0be6843120195f876631e92205430f8a389d23c6c9f85b72b4fd7b646551ede464eebaa28db1988a0b831642ab7d3c0e633cdfe28f5279ab29f69aa3bb6bb755 SHA512 ad21464b95ff69b0d8a54f54eee11d638738ba79a87fc5834d409af2d183e5a68e706b3f5df49223dd784e634de353335689981228c7ca57edf94794434d6ea9
 AUX ksh-2020.0.0-ensure-user-set.patch 1017 BLAKE2B 8a0d9fd9fd8940969741214f6ba9251ae1b404bae80385d79428ab7231a5809bafcaa5033084af0582872171666e89b590b7c2cfba1ded740da49c77b1751888 SHA512 bea76ef4350d2813395bbfaa682b97a34548292efe9986a1d63dde2476bbfbfd21dc9b10ccb7ac3bcf33e9aeb3c0eebdcffb22a3b6472302597473ac994b2493
 AUX ksh-2020.0.0-skip-api-test.patch 1394 BLAKE2B bcf521012bb197d234b119dc56ddc068f8ec3e46b6f4c6d82e1043629368bfcabd1a5d360bae702777e5b01914ac70c9edbdce5ee0bba7e9f69916a3c38b1820 SHA512 e4314599821b3f654b4c87900aa696930953a96b984f43ca00fd17aa91b968ed8f277944c6736ebddae4ee7086e9806f84e3432b24450565d1c679bdbb39e01a
 DIST ksh-2020.0.0.tar.gz 2022880 BLAKE2B cb952c4febe88a3ccf8fd48f511a30a73bfc812ebf0b7a5fe799470b29ee13ca61004fd34e367d836940a88214da2aa05b7cb96f173a1b8d57c8e644c8c3a2a6 SHA512 7d6da3af341a62718d691ddc52e10bdf3b7290d74f1cd01610093c587af47b6d6d04b74b210eb31f93a3559855a5bc5155f9b188d2f8bb4444042c26bfaf1792
-EBUILD ksh-2020.0.0.ebuild 1087 BLAKE2B d4de3298e870b57abfd03b24e8bd7c40d166749452317ca52fde421634e6ba6ead52b3e736df297b04f8e6575735df0cbf0ff620e473a942abf6c61af51660a9 SHA512 69440a0266c563586fce52171e986b742ff40abcf9089b3a9f3b8307a221f5d0f9d0f5b944ada20216a404d99d86998b9d02045d78af4b61142f863e5ec63d2a
+EBUILD ksh-2020.0.0-r1.ebuild 1123 BLAKE2B a1ca7574835877a1354c39ccb6c65c4ae4aba7f7bfdd3c198b641f97174841a46bd6a3dc931808418ff0fa2a93e16d2a9fc11774f1b7d4c24b7f3899a2d6c4ff SHA512 1dc0af0d3469c8a9d106880d7b8e21c6bc48e6629965de6e53880bdca308e63f93bf610775592795c5d5caa844a9083fe8f4ba5fadb03ecb93bb3fb3095a6e0c
 EBUILD ksh-9999.ebuild 976 BLAKE2B 4807cd3805a2f7f05a726019c707c6fe0106b636f0d221f31dd08b62b249df4815cb4bf6c5b0309863e2916a919c53aabcbe4c8efe3e8218655f2078cbb03361 SHA512 09f6498596ea5cf1c9a49eec1d8572a30b27649b0aa3a1eda99eaff959279627db59fd3a694a5929e8075dc2e641bfa65442a1a4819b9f1af5ca174d91bb5fb5
 MISC metadata.xml 1371 BLAKE2B ab655b6d15894748f8125dcc0d25fd15aee57623de8b643793b1ca456025ee35db091b500f91b59ca0801778eb65798162b732778c56b80adff4f0402b299638 SHA512 b74fe4a12ce5868839cd32fe9c4f88c216a0703a3f477b005dcf7b47f697d129c695a011a9b37894c39716b5d47ddc9abeb5bd4946ba6b6849707a73b5901810
diff --git a/app-shells/ksh/files/CVE-2019-14868.patch b/app-shells/ksh/files/CVE-2019-14868.patch
new file mode 100644
index 000000000000..d5c80566bafc
--- /dev/null
+++ b/app-shells/ksh/files/CVE-2019-14868.patch
@@ -0,0 +1,89 @@
+From c7de8b641266bac7c77942239ac659edfee9ecd2 Mon Sep 17 00:00:00 2001
+From: Kurtis Rader <krader@skepticism.us>
+Date: Thu, 12 Dec 2019 18:46:50 -0800
+Subject: [PATCH] Harden env var imports
+
+---
+ src/cmd/ksh93/sh/arith.c        | 37 ++++++++++++++++++++++-----------
+ src/cmd/ksh93/tests/subshell.sh | 23 ++++++++++++++++++++
+
+diff --git a/src/cmd/ksh93/sh/arith.c b/src/cmd/ksh93/sh/arith.c
+index 30b3067590a2..8e68cbdc868a 100644
+--- a/src/cmd/ksh93/sh/arith.c
++++ b/src/cmd/ksh93/sh/arith.c
+@@ -567,19 +567,32 @@ Sfdouble_t sh_strnum(Shell_t *shp, const char *str, char **ptr, int mode) {
+     char *last;
+ 
+     if (*str == 0) {
+-        if (ptr) *ptr = (char *)str;
+-        return 0;
+-    }
+-    errno = 0;
+-    d = number(str, &last, shp->inarith ? 0 : 10, NULL);
+-    if (*last) {
+-        if (*last != '.' || last[1] != '.') {
+-            d = strval(shp, str, &last, arith, mode);
+-            Varsubscript = true;
++        d = 0.0;
++        last = (char *)str;
++    } else {
++        d = number(str, &last, shp->inarith ? 0 : 10, NULL);
++        if (*last && !shp->inarith && sh_isstate(shp, SH_INIT)) {
++            // This call is to handle "base#value" literals if we're importing untrusted env vars.
++            d = number(str, &last, 0, NULL);
++        }
++        if (*last) {
++            if (sh_isstate(shp, SH_INIT)) {
++                // Initializing means importing untrusted env vars. Since the string does not appear
++                // to be a recognized numeric literal give up. We can't safely call strval() since
++                // that allows arbitrary expressions which would create a security vulnerability.
++                d = 0.0;
++            } else {
++                if (*last != '.' || last[1] != '.') {
++                    d = strval(shp, str, &last, arith, mode);
++                    Varsubscript = true;
++                }
++                if (!ptr && *last && mode > 0) {
++                    errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str);
++                }
++            }
++        } else if (d == 0.0 && *str == '-') {
++            d = -0.0;
+         }
+-        if (!ptr && *last && mode > 0) errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str);
+-    } else if (!d && *str == '-') {
+-        d = -0.0;
+     }
+     if (ptr) *ptr = last;
+     return d;
+diff --git a/src/cmd/ksh93/tests/subshell.sh b/src/cmd/ksh93/tests/subshell.sh
+index b63a8051ed5c..3faba475d6de 100644
+--- a/src/cmd/ksh93/tests/subshell.sh
++++ b/src/cmd/ksh93/tests/subshell.sh
+@@ -856,3 +856,26 @@ for exp in 65535 65536
+ do    got=$($SHELL -c 'x=$(printf "%.*c" '$exp' x); print ${#x}' 2>&1)
+     [[ $got == $exp ]] || log_error "large command substitution failed" "$exp" "$got"
+ done
++
++# ==========
++# Verify that importing untrusted env vars does not allow evaluating arbitrary expressions but does
++# recognize all integer literals recognized by ksh.
++expect=8
++actual=$(env SHLVL='7' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "decimal int literal not recognized" "$expect" "$actual"
++
++expect=14
++actual=$(env SHLVL='013' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "leading zeros int literal not recognized" "$expect" "$actual"
++
++expect=4
++actual=$(env SHLVL='2#11' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual"
++
++expect=12
++actual=$(env SHLVL='16#B' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual"
++
++expect=1
++actual=$(env SHLVL="2#11+x[\$($bin_echo DANGER WILL ROBINSON >&2)0]" $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "expression allowed on env var import" "$expect" "$actual"
diff --git a/app-shells/ksh/ksh-2020.0.0.ebuild b/app-shells/ksh/ksh-2020.0.0-r1.ebuild
index 6b40cd312997..3c4891ea637e 100644
--- a/app-shells/ksh/ksh-2020.0.0.ebuild
+++ b/app-shells/ksh/ksh-2020.0.0-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -27,6 +27,7 @@ RDEPEND="!app-shells/pdksh"
 PATCHES=(
 	"${FILESDIR}"/ksh-2020.0.0-ensure-user-set.patch
 	"${FILESDIR}"/ksh-2020.0.0-skip-api-test.patch
+	"${FILESDIR}"/CVE-2019-14868.patch
 )
 
 src_test() {