Fix for argv for setuid scripts (Solaris patch 115-CR6934836)

McDutchie · McDutchie · commit bae02c39b6e2 · 2021-01-08T11:28:33.000Z
This change is pulled from here: https://github.com/oracle/solaris-userland/blob/master/components/ksh93/patches/115-CR6934836.patch Unfortunately there is no publicly available documentation on what this does or why it was needed. We just have to assume the Solaris people knew what they were doing. ksh2020 upstreamed this too (as well as all the other Solaris patches applied here).
diff --git a/src/cmd/ksh93/include/defs.h b/src/cmd/ksh93/include/defs.h
@@ -102,6 +102,8 @@ struct sh_scoped
 	char		**otrapcom;
 	void		*timetrap;
 	struct Ufunction *real_fun;	/* current 'function name' function */
+	int             repl_index;
+	char            *repl_arg;
 };
 
 struct limits
diff --git a/src/cmd/ksh93/sh/init.c b/src/cmd/ksh93/sh/init.c
@@ -1339,6 +1339,7 @@ Shell_t *sh_init(register int argc,register char *argv[], Shinit_f userinit)
 	sh_onoption(SH_MULTILINE);
 	if(argc>0)
 	{
+		int dolv_index;
 		/* check for restricted shell */
 		if(type&SH_TYPE_RESTRICTED)
 			sh_onoption(SH_RESTRICTED);
@@ -1355,7 +1356,10 @@ Shell_t *sh_init(register int argc,register char *argv[], Shinit_f userinit)
 			sh_done(shp,0);
 		}
 		opt_info.disc = 0;
-		shp->st.dolv=argv+(argc-1)-shp->st.dolc;
+		dolv_index = (argc - 1) - shp->st.dolc;
+		shp->st.dolv = argv + dolv_index;
+		shp->st.repl_index = dolv_index;
+		shp->st.repl_arg = argv[dolv_index];
 		shp->st.dolv[0] = argv[0];
 		if(shp->st.dolc < 1)
 		{
diff --git a/src/cmd/ksh93/sh/main.c b/src/cmd/ksh93/sh/main.c
@@ -267,6 +267,8 @@ int sh_main(int ac, char *av[], Shinit_f userinit)
 					 * try to undo effect of solaris 2.5+
 					 * change for argv for setuid scripts
 					 */
+					if(shp->st.repl_index > 0)
+						av[shp->st.repl_index] = shp->st.repl_arg;
 					if(((type = sh_type(cp = av[0])) & SH_TYPE_SH) && (name = nv_getval(L_ARGNOD)) && (!((type = sh_type(cp = name)) & SH_TYPE_SH)))
 					{
 						av[0] = (type & SH_TYPE_LOGIN) ? cp : path_basename(cp);

Original file line number	Diff line number	Diff line change
`@@ -1339,6 +1339,7 @@ Shell_t sh_init(register int argc,register char argv[], Shinit_f userinit)`
`1339`	`1339`	`sh_onoption(SH_MULTILINE);`
`1340`	`1340`	`if(argc>0)`
`1341`	`1341`	`{`
	`1342`	`+ int dolv_index;`
`1342`	`1343`	`/* check for restricted shell */`
`1343`	`1344`	`if(type&SH_TYPE_RESTRICTED)`
`1344`	`1345`	`sh_onoption(SH_RESTRICTED);`
`@@ -1355,7 +1356,10 @@ Shell_t sh_init(register int argc,register char argv[], Shinit_f userinit)`
`1355`	`1356`	`sh_done(shp,0);`
`1356`	`1357`	`}`
`1357`	`1358`	`opt_info.disc = 0;`
`1358`		`- shp->st.dolv=argv+(argc-1)-shp->st.dolc;`
	`1359`	`+ dolv_index = (argc - 1) - shp->st.dolc;`
	`1360`	`+ shp->st.dolv = argv + dolv_index;`
	`1361`	`+ shp->st.repl_index = dolv_index;`
	`1362`	`+ shp->st.repl_arg = argv[dolv_index];`
`1359`	`1363`	`shp->st.dolv[0] = argv[0];`
`1360`	`1364`	`if(shp->st.dolc < 1)`
`1361`	`1365`	`{`
Original file line number	Diff line number	Diff line change
`@@ -267,6 +267,8 @@ int sh_main(int ac, char *av[], Shinit_f userinit)`
`267`	`267`	`* try to undo effect of solaris 2.5+`
`268`	`268`	`* change for argv for setuid scripts`
`269`	`269`	`*/`
	`270`	`+ if(shp->st.repl_index > 0)`
	`271`	`+ av[shp->st.repl_index] = shp->st.repl_arg;`
`270`	`272`	`if(((type = sh_type(cp = av[0])) & SH_TYPE_SH) && (name = nv_getval(L_ARGNOD)) && (!((type = sh_type(cp = name)) & SH_TYPE_SH)))`
`271`	`273`	`{`
`272`	`274`	`av[0] = (type & SH_TYPE_LOGIN) ? cp : path_basename(cp);`