Revert "exec: load_script: don't blindly truncate shebang string"
This reverts commit 8099b047ec
.
It turns out that people do actually depend on the shebang string being
truncated, and on the fact that an interpreter (like perl) will often
just re-interpret it entirely to get the full argument list.
Reported-by: Samuel Dionne-Riel <samuel@dionne-riel.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
23e93c9b2c
commit
cb5b020a8d
|
@ -42,14 +42,10 @@ static int load_script(struct linux_binprm *bprm)
|
|||
fput(bprm->file);
|
||||
bprm->file = NULL;
|
||||
|
||||
for (cp = bprm->buf+2;; cp++) {
|
||||
if (cp >= bprm->buf + BINPRM_BUF_SIZE)
|
||||
return -ENOEXEC;
|
||||
if (!*cp || (*cp == '\n'))
|
||||
break;
|
||||
}
|
||||
bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
|
||||
if ((cp = strchr(bprm->buf, '\n')) == NULL)
|
||||
cp = bprm->buf+BINPRM_BUF_SIZE-1;
|
||||
*cp = '\0';
|
||||
|
||||
while (cp > bprm->buf) {
|
||||
cp--;
|
||||
if ((*cp == ' ') || (*cp == '\t'))
|
||||
|
|
Loading…
Reference in New Issue