leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "exec: load_script: don't blindly truncate shebang string"

Browse Source 
This reverts commit 8099b047ec.

It turns out that people do actually depend on the shebang string being
truncated, and on the fact that an interpreter (like perl) will often
just re-interpret it entirely to get the full argument list.

Reported-by: Samuel Dionne-Riel <samuel@dionne-riel.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Linus Torvalds
2019-02-14 15:02:18 -08:00
parent 23e93c9b2c
commit cb5b020a8d
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
fs/binfmt_script.c
View File

@@ -42,14 +42,10 @@ static int load_script(struct linux_binprm *bprm)
fput(bprm->file); fput(bprm->file);
bprm->file = NULL; bprm->file = NULL;
for (cp = bprm->buf+2;; cp++) { bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
if (cp >= bprm->buf + BINPRM_BUF_SIZE) if ((cp = strchr(bprm->buf, '\n')) == NULL)
return -ENOEXEC; cp = bprm->buf+BINPRM_BUF_SIZE-1;
if (!*cp || (*cp == '\n'))
break;
}
*cp = '\0'; *cp = '\0';
while (cp > bprm->buf) { while (cp > bprm->buf) {
cp--; cp--;
if ((*cp == ' ') || (*cp == '\t')) if ((*cp == ' ') || (*cp == '\t'))