rpms/emacs
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import emacs-27.2-8.el9_2.1

Browse Source
This commit is contained in:
CentOS Sources 2023-05-09 10:16:05 +00:00 committed by Stepan Oksanichenko
parent caf6d05890
commit 1047e648fc
5 changed files with 218 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

105
SOURCES/emacs-etags-local-command-injection-vulnerability.patch Normal file
View File

@ -0,0 +1,105 @@
From 01a4035c869b91c153af9a9132c87adb7669ea1c Mon Sep 17 00:00:00 2001
From: lu4nx <lx@shellcodes.org>
Date: Tue, 6 Dec 2022 15:42:40 +0800
Subject: [PATCH] Fix etags local command injection vulnerability
* lib-src/etags.c: (escape_shell_arg_string): New function.
(process_file_name): Use it to quote file names passed to the
shell. (Bug#59817)
---
lib-src/etags.c | 63 +++++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 58 insertions(+), 5 deletions(-)
diff --git a/lib-src/etags.c b/lib-src/etags.c
index d1d20858cdd..ba0092cc637 100644
--- a/lib-src/etags.c
+++ b/lib-src/etags.c
@@ -399,6 +399,7 @@ static void put_entries (node *);
static void clean_matched_file_tag (char const * const, char const * const);
static void do_move_file (const char *, const char *);
+static char *escape_shell_arg_string (char *);
static char *concat (const char *, const char *, const char *);
static char *skip_spaces (char *);
static char *skip_non_spaces (char *);
@@ -1670,13 +1671,16 @@ process_file_name (char *file, language *lang)
else
{
#if MSDOS || defined (DOS_NT)
- char *cmd1 = concat (compr->command, " \"", real_name);
- char *cmd = concat (cmd1, "\" > ", tmp_name);
+ int buf_len = strlen (compr->command) + strlen (" \"\" > \"\"") + strlen (real_name) + strlen (tmp_name) + 1;
+ char *cmd = xmalloc (buf_len);
+ snprintf (cmd, buf_len, "%s \"%s\" > \"%s\"", compr->command, real_name, tmp_name);
#else
- char *cmd1 = concat (compr->command, " '", real_name);
- char *cmd = concat (cmd1, "' > ", tmp_name);
+ char *new_real_name = escape_shell_arg_string (real_name);
+ char *new_tmp_name = escape_shell_arg_string (tmp_name);
+ int buf_len = strlen (compr->command) + strlen (" > ") + strlen (new_real_name) + strlen (new_tmp_name) + 1;
+ char *cmd = xmalloc (buf_len);
+ snprintf (cmd, buf_len, "%s %s > %s", compr->command, new_real_name, new_tmp_name);
#endif
- free (cmd1);
int tmp_errno;
if (system (cmd) == -1)
{
@@ -7124,6 +7128,55 @@ etags_mktmp (void)
return templt;
}
+/*
+ * Adds single quotes around a string, if found single quotes, escaped it.
+ * Return a newly-allocated string.
+ *
+ * For example:
+ * escape_shell_arg_string("test.txt") => 'test.txt'
+ * escape_shell_arg_string("'test.txt") => ''\''test.txt'
+ */
+static char *
+escape_shell_arg_string (char *str)
+{
+ char *p = str;
+ int need_space = 2; /* ' at begin and end */
+
+ while (*p != '\0')
+ {
+ if (*p == '\'')
+ need_space += 4; /* ' to '\'', length is 4 */
+ else
+ need_space++;
+
+ p++;
+ }
+
+ char *new_str = xnew (need_space + 1, char);
+ new_str[0] = '\'';
+ new_str[need_space-1] = '\'';
+
+ int i = 1; /* skip first byte */
+ p = str;
+ while (*p != '\0')
+ {
+ new_str[i] = *p;
+ if (*p == '\'')
+ {
+ new_str[i+1] = '\\';
+ new_str[i+2] = '\'';
+ new_str[i+3] = '\'';
+ i += 3;
+ }
+
+ i++;
+ p++;
+ }
+
+ new_str[need_space] = '\0';
+ return new_str;
+}
+
static void
do_move_file(const char *src_file, const char *dst_file)
{
--
2.36.1

26
SOURCES/emacs-htmlfontify-command-injection-vulnerability.patch Normal file
View File

@ -0,0 +1,26 @@
From 1b4dc4691c1f87fc970fbe568b43869a15ad0d4c Mon Sep 17 00:00:00 2001
From: Xi Lu <lx@shellcodes.org>
Date: Sat, 24 Dec 2022 16:28:54 +0800
Subject: [PATCH] Fix htmlfontify.el command injection vulnerability.
* lisp/htmlfontify.el (hfy-text-p): Fix command injection
vulnerability. (Bug#60295)
---
lisp/htmlfontify.el | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lisp/htmlfontify.el b/lisp/htmlfontify.el
index df4c6ab079c..389b92939cc 100644
--- a/lisp/htmlfontify.el
+++ b/lisp/htmlfontify.el
@@ -1912,7 +1912,7 @@ hfy-make-directory
(defun hfy-text-p (srcdir file)
"Is SRCDIR/FILE text? Uses `hfy-istext-command' to determine this."
- (let* ((cmd (format hfy-istext-command (expand-file-name file srcdir)))
+ (let* ((cmd (format hfy-istext-command (shell-quote-argument (expand-file-name file srcdir))))
(rsp (shell-command-to-string cmd)))
(string-match "text" rsp)))
--
2.36.1

43
SOURCES/emacs-ob-latex-command-injection-vulnerability.patch Normal file
View File

@ -0,0 +1,43 @@
From a8006ea580ed74f27f974d60b598143b04ad1741 Mon Sep 17 00:00:00 2001
From: Xi Lu <lx@shellcodes.org>
Date: Sat, 11 Mar 2023 18:53:37 +0800
Subject: * lisp/org/ob-latex.el: Fix command injection vulnerability
(org-babel-execute:latex):
Replaced the `(shell-command "mv BAR NEWBAR")' with `rename-file'.
TINYCHANGE
---
lisp/org/ob-latex.el | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/lisp/org/ob-latex.el b/lisp/org/ob-latex.el
index a2c24b3..ce39628 100644
--- a/lisp/org/ob-latex.el
+++ b/lisp/org/ob-latex.el
@@ -218,17 +218,14 @@ This function is called by `org-babel-execute-src-block'."
(if (string-suffix-p ".svg" out-file)
(progn
(shell-command "pwd")
- (shell-command (format "mv %s %s"
- (concat (file-name-sans-extension tex-file) "-1.svg")
- out-file)))
+ (rename-file (concat (file-name-sans-extension tex-file) "-1.svg")
+ out-file t))
(error "SVG file produced but HTML file requested")))
((file-exists-p (concat (file-name-sans-extension tex-file) ".html"))
(if (string-suffix-p ".html" out-file)
- (shell-command "mv %s %s"
- (concat (file-name-sans-extension tex-file)
- ".html")
- out-file)
- (error "HTML file produced but SVG file requested")))))
+ (rename-file (concat (file-name-sans-extension tex-file) ".html")
+ out-file t)
+ (error "HTML file produced but SVG file requested")))))
((or (string= "pdf" extension) imagemagick)
(with-temp-file tex-file
(require 'ox-latex)
--
cgit v1.1

28
SOURCES/emacs-ruby-mode-local-command-injection-vulnerability.patch Normal file
View File

@ -0,0 +1,28 @@
From 9a3b08061feea14d6f37685ca1ab8801758bfd1c Mon Sep 17 00:00:00 2001
From: Xi Lu <lx@shellcodes.org>
Date: Fri, 23 Dec 2022 12:52:48 +0800
Subject: [PATCH] Fix ruby-mode.el local command injection vulnerability
(bug#60268)
* lisp/progmodes/ruby-mode.el
(ruby-find-library-file): Fix local command injection vulnerability.
---
lisp/progmodes/ruby-mode.el | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lisp/progmodes/ruby-mode.el b/lisp/progmodes/ruby-mode.el
index 1f3e9b6ae7b..a4aa61905e4 100644
--- a/lisp/progmodes/ruby-mode.el
+++ b/lisp/progmodes/ruby-mode.el
@@ -1820,7 +1820,7 @@ ruby-find-library-file
(setq feature-name (read-string "Feature name: " init))))
(let ((out
(substring
- (shell-command-to-string (concat "gem which " feature-name))
+ (shell-command-to-string (concat "gem which " (shell-quote-argument feature-name)))
0 -1)))
(if (string-match-p "\\`ERROR" out)
(user-error "%s" out)
--
2.36.1

18
SPECS/emacs.spec
View File

@ -5,7 +5,7 @@ Summary: GNU Emacs text editor
Name: emacs Name: emacs
Epoch: 1 Epoch: 1
Version: 27.2 Version: 27.2
Release: 8%{?dist} Release: 8%{?dist}.1
License: GPLv3+ and CC0-1.0 License: GPLv3+ and CC0-1.0
URL: http://www.gnu.org/software/emacs/ URL: http://www.gnu.org/software/emacs/
Source0: https://ftp.gnu.org/gnu/emacs/emacs-%{version}.tar.xz Source0: https://ftp.gnu.org/gnu/emacs/emacs-%{version}.tar.xz
@ -29,6 +29,10 @@ Patch2: emacs-system-crypto-policies.patch
Patch3: emacs-glibc-2.34.patch Patch3: emacs-glibc-2.34.patch
Patch4: emacs-ctags-local-command-execute-vulnerability.patch Patch4: emacs-ctags-local-command-execute-vulnerability.patch
Patch5: emacs-64KB-page-size-for-pdump.patch Patch5: emacs-64KB-page-size-for-pdump.patch
Patch6: emacs-etags-local-command-injection-vulnerability.patch
Patch7: emacs-htmlfontify-command-injection-vulnerability.patch
Patch8: emacs-ruby-mode-local-command-injection-vulnerability.patch
Patch9: emacs-ob-latex-command-injection-vulnerability.patch
BuildRequires: gcc BuildRequires: gcc
BuildRequires: atk-devel BuildRequires: atk-devel
BuildRequires: cairo-devel BuildRequires: cairo-devel
@ -193,6 +197,10 @@ Development header files for Emacs.
%patch3 -p1 -b .glibc2.34 %patch3 -p1 -b .glibc2.34
%patch4 -p1 -b .ctags-local-command-execute-vulnerability %patch4 -p1 -b .ctags-local-command-execute-vulnerability
%patch5 -p1 -b .64KB-page-size-for-pdump %patch5 -p1 -b .64KB-page-size-for-pdump
%patch6 -p1 -b .etags-local-command-injection-vulnerability
%patch7 -p1 -b .htmlfontify-command-injection-vulnerability
%patch8 -p1 -b .ruby-mode-local-command-injection-vulnerability
%patch9 -p1 -b .ob-latex-command-injection-vulnerability
autoconf autoconf
# We prefer our emacs.desktop file # We prefer our emacs.desktop file
@ -483,6 +491,12 @@ rm %{buildroot}%{_datadir}/icons/hicolor/scalable/mimetypes/emacs-document23.svg
%{_includedir}/emacs-module.h %{_includedir}/emacs-module.h
%changelog %changelog
* Tue Apr 4 2023 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-8.1
- Fix etags local command injection vulnerability (#2184369)
- Fix htmlfontify.el command injection vulnerability (#2184368)
- Fix ruby-mode.el local command injection vulnerability (#2184367)
- Fix ob-latex.el command injection vulnerability (#2184377)
* Tue Jan 10 2023 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-8 * Tue Jan 10 2023 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-8
- Use a 64KB page size for pdump (#1979804) - Use a 64KB page size for pdump (#1979804)
@ -505,7 +519,7 @@ rm %{buildroot}%{_datadir}/icons/hicolor/scalable/mimetypes/emacs-document23.svg
* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 1:27.2-2 * Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 1:27.2-2
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Thu Mar 27 2021 Bhavin Gandhi <bhavin7392@gmail.com> - 1:27.2-1 * Sat Mar 27 2021 Bhavin Gandhi <bhavin7392@gmail.com> - 1:27.2-1
- emacs-27.2 is available - emacs-27.2 is available
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1:27.1-3 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1:27.1-3