mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-04 16:15:11 +00:00
Revert "exec: load_script: don't blindly truncate shebang string"
commitcb5b020a8d
upstream. This reverts commit8099b047ec
. It turns out that people do actually depend on the shebang string being truncated, and on the fact that an interpreter (like perl) will often just re-interpret it entirely to get the full argument list. Reported-by: Samuel Dionne-Riel <samuel@dionne-riel.com> Acked-by: Kees Cook <keescook@chromium.org> Cc: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
557ac4e207
commit
56f88d7584
1 changed files with 3 additions and 7 deletions
|
@ -42,14 +42,10 @@ static int load_script(struct linux_binprm *bprm)
|
|||
fput(bprm->file);
|
||||
bprm->file = NULL;
|
||||
|
||||
for (cp = bprm->buf+2;; cp++) {
|
||||
if (cp >= bprm->buf + BINPRM_BUF_SIZE)
|
||||
return -ENOEXEC;
|
||||
if (!*cp || (*cp == '\n'))
|
||||
break;
|
||||
}
|
||||
bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
|
||||
if ((cp = strchr(bprm->buf, '\n')) == NULL)
|
||||
cp = bprm->buf+BINPRM_BUF_SIZE-1;
|
||||
*cp = '\0';
|
||||
|
||||
while (cp > bprm->buf) {
|
||||
cp--;
|
||||
if ((*cp == ' ') || (*cp == '\t'))
|
||||
|
|
Loading…
Reference in a new issue