Path: csiph.com!goblin2!goblin1!goblin.stu.neva.ru!usenet.stanford.edu!not-for-mail
From: Koichi Murase <myoga.murase@gmail.com>
Newsgroups: gnu.bash.bug
Subject: [PATCH] `bind -x' inside `bind -x' bindings causes execution of random strings
Date: Fri, 4 May 2018 00:27:29 +0900
Lines: 91
Approved: bug-bash@gnu.org
Message-ID: <mailman.13355.1525361254.27995.bug-bash@gnu.org>
NNTP-Posting-Host: lists.gnu.org
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="0000000000007013b9056b4ed76c"
To: bug-bash@gnu.org
Envelope-to: bug-bash@gnu.org
Precedence: list
Xref: csiph.com gnu.bash.bug:14088

--0000000000007013b9056b4ed76c
Content-Type: text/plain; charset="UTF-8"

Configuration Information [Automatically generated, do not change]:
Machine: i686
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i686'
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i686-pc-linux-gnu'
-DCONF_VENDOR='pc'
-DLOCALEDIR='/home/murase/opt/bash-4.4.19/share/locale' -DPACKAGE=\
'bash' -DSHELL -DHAVE_CONFIG_H   -I.  -I. -I./include -I./lib   -O2
-march=native -Wno-parentheses -Wno-format-security
uname output: Linux padparadscha 4.13.13-100.fc25.i686 #1 SMP Wed Nov
15 18:24:19 UTC 2017 i686 i686 i386 GNU/Linux
Machine Type: i686-pc-linux-gnu

Bash Version: 4.4
Patch Level: 19
Release Status: release

Description:

  After calls of `bind -x' inside functions called via `bind -x',
random strings are executed as a command.

  This happens in the following way: When the binding is overwritten
using `bind -x' inside the function called through `bind -x' bindings,
the original string registered for the binding is deallocated although
it is still under evaluation. Then the memory block will be allocated
for other purposes and the content will be rewritten. Finally the new
data written to the memory block is evaluated.

Repeat-By:

  The following example is a minimal example that reproduces the problem.

  $ bash-4.4 --norc
  $ f1() { bind -x '"\C-t": f1'; }; f1

  After this, on typing `C-t', a random string is executed as a
command string and produces error messages like:

  bash-4.4: $'\317\003': command not found

  At least all the versions from Bash 4.0 to Bash 4.4 have the same
problem. I haven't checked for Bash 3.2 or older versions.

Fix:

  Maybe the usage in the above example seems useless to some people,
but it's just a reduced example. In my complex scripts I do need to
rebind key bindings in `bind -x' functions. I attach a patch for devel
branch to allow safe `bind -x' inside the function called through
`bind -x' bindings.

  Also the execution of random memory contents can generally be a
security issue although I'm not sure if this problem can really be
used for attacks. Basically the content written to the deallocated
strings is not under control, but it's difficult to ensure that there
is no way for other user to control the content. So maybe it's better
to apply this fix also to older versions of Bash.

Best regards,
Koichi

--0000000000007013b9056b4ed76c
Content-Type: application/octet-stream; 
	name="0001-fix-a-bug-that-random-commands-are-executed-after-bi.patch"
Content-Disposition: attachment; 
	filename="0001-fix-a-bug-that-random-commands-are-executed-after-bi.patch"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_jgqokqxt0

RnJvbSBmYjdjYzAyZmMxY2E4YTA5NmVjNmZmZjBkYzBhMTFiODgwZWFiZTlmIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBLb2ljaGkgTXVyYXNlIDxteW9nYS5tdXJhc2VAZ21haWwuY29t
PgpEYXRlOiBNb24sIDE2IEFwciAyMDE4IDIzOjUwOjEzICswOTAwClN1YmplY3Q6IFtQQVRDSF0g
Zml4IGEgYnVnIHRoYXQgcmFuZG9tIGNvbW1hbmRzIGFyZSBleGVjdXRlZCBhZnRlciAiYmluZCIg
aW4gYQogImJpbmQgLXgiIGZ1bmN0aW9uCgotLS0KIGJhc2hsaW5lLmMgfCAyICstCiAxIGZpbGUg
Y2hhbmdlZCwgMSBpbnNlcnRpb24oKyksIDEgZGVsZXRpb24oLSkKCmRpZmYgLS1naXQgYS9iYXNo
bGluZS5jIGIvYmFzaGxpbmUuYwppbmRleCA5MWQ0NDQ2Li5lODAwYzdjIDEwMDY0NAotLS0gYS9i
YXNobGluZS5jCisrKyBiL2Jhc2hsaW5lLmMKQEAgLTQxNDcsNyArNDE0Nyw3IEBAIGJhc2hfZXhl
Y3V0ZV91bml4X2NvbW1hbmQgKGNvdW50LCBrZXkpCiAgIGFycmF5X25lZWRzX21ha2luZyA9IDE7
CiAKICAgc2F2ZV9wYXJzZXJfc3RhdGUgKCZwcyk7Ci0gIHIgPSBwYXJzZV9hbmRfZXhlY3V0ZSAo
Y21kLCAiYmFzaF9leGVjdXRlX3VuaXhfY29tbWFuZCIsIFNFVkFMX05PSElTVHxTRVZBTF9OT0ZS
RUUpOworICByID0gcGFyc2VfYW5kX2V4ZWN1dGUgKHNhdmVzdHJpbmcgKGNtZCksICJiYXNoX2V4
ZWN1dGVfdW5peF9jb21tYW5kIiwgU0VWQUxfTk9ISVNUKTsKICAgcmVzdG9yZV9wYXJzZXJfc3Rh
dGUgKCZwcyk7CiAKICAgdiA9IGZpbmRfdmFyaWFibGUgKCJSRUFETElORV9MSU5FIik7Ci0tIAoy
LjkuNQoK
--0000000000007013b9056b4ed76c--