Bug#1006504: bullseye-pu: package bash/5.1-6~deb11u1
Hi Julien, On Sun, Mar 27, 2022 at 09:18:06PM +0200, Julien Cristau wrote: > Control: tag -1 confirmed > > On Sun, Mar 27, 2022 at 09:04:03PM +0200, Salvatore Bonaccorso wrote: > > Okay attached the alternative, and only cherry-pick the 014 patch > > upstream to address #1003012. Would that be acceptable instead? > > > That's fine, thanks. Thanks Julien. Uploaded. Regards, Salvatore
Bug#1006504: bullseye-pu: package bash/5.1-6~deb11u1
Control: tag -1 confirmed On Sun, Mar 27, 2022 at 09:04:03PM +0200, Salvatore Bonaccorso wrote: > Okay attached the alternative, and only cherry-pick the 014 patch > upstream to address #1003012. Would that be acceptable instead? > That's fine, thanks. Cheers, Julien
Processed: Re: Bug#1006504: bullseye-pu: package bash/5.1-6~deb11u1
Processing control commands: > tag -1 confirmed Bug #1006504 [release.debian.org] bullseye-pu: package bash/5.1-2+deb11u1 Added tag(s) confirmed. -- 1006504: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006504 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1006504: bullseye-pu: package bash/5.1-6~deb11u1
Control: tags -1 - moreinfo Control: retitle -1 bullseye-pu: package bash/5.1-2+deb11u1 Hi Julien On Sat, Mar 19, 2022 at 10:02:54PM +0100, Salvatore Bonaccorso wrote: > Hi Julien, > > On Sat, Mar 19, 2022 at 06:36:16PM +0100, Julien Cristau wrote: > > Control: tag -1 moreinfo > > > > On Sat, Feb 26, 2022 at 03:25:09PM +0100, Salvatore Bonaccorso wrote: > > > There was a request in #1003012 to fix an issue in bash corrupting > > > multibyte characters in command substitutions. > > > > > > While looking at it I'm proposing here instead of only picking the 014 > > > patch, to pick up all the changes done since from the bullseye release > > > on top and so proposing a rebuilding of 5.1-6 which was expoed in > > > testing for awhile now. Only change reverted would be the bump of > > > standards version but still including the drop of the pre-wheezy > > > preinst for the "dash-as-sh"-transition. > > > > > > Attached is the resulting debdiff as proposed with the rebuild. > > > > > > Matthias, Stable release managers what do you think on the update? > > > > > I'm unconvinced. Dropping the preinst seems way out of scope for a > > stable update, as for the other changes it's unclear to me what their > > impact/risk is. > > This is why I hoped to see what Matthias thinks. The alternative > would clearly be to only cherry pick the fix for #1003012 and do > 5.1-2+deb11u1 with it. Okay attached the alternative, and only cherry-pick the 014 patch upstream to address #1003012. Would that be acceptable instead? Regards, Salvatore diff -Nru bash-5.1/debian/changelog bash-5.1/debian/changelog --- bash-5.1/debian/changelog 2021-01-03 10:44:50.0 +0100 +++ bash-5.1/debian/changelog 2022-03-27 20:40:30.0 +0200 @@ -1,3 +1,10 @@ +bash (5.1-2+deb11u1) bullseye; urgency=medium + + * Non-maintainer upload. + * 1-byte buffer overflow read in subst.c read_comsub (Closes: #1003012) + + -- Salvatore Bonaccorso Sun, 27 Mar 2022 20:40:30 +0200 + bash (5.1-2) unstable; urgency=medium * Apply upstream patches 001 - 004. diff -Nru bash-5.1/debian/patches/bash51-014.diff bash-5.1/debian/patches/bash51-014.diff --- bash-5.1/debian/patches/bash51-014.diff 1970-01-01 01:00:00.0 +0100 +++ bash-5.1/debian/patches/bash51-014.diff 2022-03-27 20:40:30.0 +0200 @@ -0,0 +1,26 @@ +BASH PATCH REPORT += + +Bash-Release: 5.1 +Patch-ID: bash51-014 + +Bug-Reported-by: platon7pro...@gmail.com +Bug-Reference-ID: +Bug-Reference-URL: https://savannah.gnu.org/patch/?10035 + +Bug-Description: + +Bash may produce corrupted input if a multibyte character spans a 512-byte +boundary while reading the output of a command substitution. + +--- a/subst.c b/subst.c +@@ -6242,7 +6242,7 @@ read_comsub (fd, quoted, flags, rflag) + /* read a multibyte character from buf */ + /* punt on the hard case for now */ + memset (, '\0', sizeof (mbstate_t)); +-mblen = mbrtowc (, bufp-1, bufn+1, ); ++mblen = mbrtowc (, bufp-1, bufn, ); + if (MB_INVALIDCH (mblen) || mblen == 0 || mblen == 1) + istring[istring_index++] = c; + else diff -Nru bash-5.1/debian/patches/series bash-5.1/debian/patches/series --- bash-5.1/debian/patches/series 2021-01-03 10:43:05.0 +0100 +++ bash-5.1/debian/patches/series 2022-03-27 20:40:30.0 +0200 @@ -2,6 +2,7 @@ bash51-002.diff bash51-003.diff bash51-004.diff +bash51-014.diff bashbug-editor.diff deb-bash-config.diff deb-examples.diff
Processed: Re: Bug#1006504: bullseye-pu: package bash/5.1-6~deb11u1
Processing control commands: > tags -1 - moreinfo Bug #1006504 [release.debian.org] bullseye-pu: package bash/5.1-6~deb11u1 Removed tag(s) moreinfo. > retitle -1 bullseye-pu: package bash/5.1-2+deb11u1 Bug #1006504 [release.debian.org] bullseye-pu: package bash/5.1-6~deb11u1 Changed Bug title to 'bullseye-pu: package bash/5.1-2+deb11u1' from 'bullseye-pu: package bash/5.1-6~deb11u1'. -- 1006504: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006504 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1006504: bullseye-pu: package bash/5.1-6~deb11u1
Hi Julien, On Sat, Mar 19, 2022 at 06:36:16PM +0100, Julien Cristau wrote: > Control: tag -1 moreinfo > > On Sat, Feb 26, 2022 at 03:25:09PM +0100, Salvatore Bonaccorso wrote: > > There was a request in #1003012 to fix an issue in bash corrupting > > multibyte characters in command substitutions. > > > > While looking at it I'm proposing here instead of only picking the 014 > > patch, to pick up all the changes done since from the bullseye release > > on top and so proposing a rebuilding of 5.1-6 which was expoed in > > testing for awhile now. Only change reverted would be the bump of > > standards version but still including the drop of the pre-wheezy > > preinst for the "dash-as-sh"-transition. > > > > Attached is the resulting debdiff as proposed with the rebuild. > > > > Matthias, Stable release managers what do you think on the update? > > > I'm unconvinced. Dropping the preinst seems way out of scope for a > stable update, as for the other changes it's unclear to me what their > impact/risk is. This is why I hoped to see what Matthias thinks. The alternative would clearly be to only cherry pick the fix for #1003012 and do 5.1-2+deb11u1 with it. Regards, Salvatore
Bug#1006504: bullseye-pu: package bash/5.1-6~deb11u1
Control: tag -1 moreinfo On Sat, Feb 26, 2022 at 03:25:09PM +0100, Salvatore Bonaccorso wrote: > There was a request in #1003012 to fix an issue in bash corrupting > multibyte characters in command substitutions. > > While looking at it I'm proposing here instead of only picking the 014 > patch, to pick up all the changes done since from the bullseye release > on top and so proposing a rebuilding of 5.1-6 which was expoed in > testing for awhile now. Only change reverted would be the bump of > standards version but still including the drop of the pre-wheezy > preinst for the "dash-as-sh"-transition. > > Attached is the resulting debdiff as proposed with the rebuild. > > Matthias, Stable release managers what do you think on the update? > I'm unconvinced. Dropping the preinst seems way out of scope for a stable update, as for the other changes it's unclear to me what their impact/risk is. Cheers, Julien
Processed: Re: Bug#1006504: bullseye-pu: package bash/5.1-6~deb11u1
Processing control commands: > tag -1 moreinfo Bug #1006504 [release.debian.org] bullseye-pu: package bash/5.1-6~deb11u1 Added tag(s) moreinfo. -- 1006504: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006504 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1006504: bullseye-pu: package bash/5.1-6~deb11u1
Hi Matthias, hi SRM'ers On Sat, Feb 26, 2022 at 03:25:09PM +0100, Salvatore Bonaccorso wrote: > Package: release.debian.org > Severity: normal > Tags: bullseye > User: release.debian@packages.debian.org > Usertags: pu > X-Debbugs-Cc: car...@debian.org,d...@debian.org > > Hi Stable Release Managers, > > [X-Debbugs-CC'ed as well Matthias so he can veto or ack from his > maintainer point of view]. > > There was a request in #1003012 to fix an issue in bash corrupting > multibyte characters in command substitutions. > > While looking at it I'm proposing here instead of only picking the 014 > patch, to pick up all the changes done since from the bullseye release > on top and so proposing a rebuilding of 5.1-6 which was expoed in > testing for awhile now. Only change reverted would be the bump of > standards version but still including the drop of the pre-wheezy > preinst for the "dash-as-sh"-transition. > > Attached is the resulting debdiff as proposed with the rebuild. > > Matthias, Stable release managers what do you think on the update? Opinions on it? Regards, Salvatore
Bug#1006504: bullseye-pu: package bash/5.1-6~deb11u1
Package: release.debian.org Severity: normal Tags: bullseye User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: car...@debian.org,d...@debian.org Hi Stable Release Managers, [X-Debbugs-CC'ed as well Matthias so he can veto or ack from his maintainer point of view]. There was a request in #1003012 to fix an issue in bash corrupting multibyte characters in command substitutions. While looking at it I'm proposing here instead of only picking the 014 patch, to pick up all the changes done since from the bullseye release on top and so proposing a rebuilding of 5.1-6 which was expoed in testing for awhile now. Only change reverted would be the bump of standards version but still including the drop of the pre-wheezy preinst for the "dash-as-sh"-transition. Attached is the resulting debdiff as proposed with the rebuild. Matthias, Stable release managers what do you think on the update? Regards, Salvatore bash_5.1-6~deb11u1.debdiff.xz Description: application/xz
