fix for CVE-2010-1646

diff --git a/debian/changelog b/debian/changelog
index f1f7375141d427df1a1bc16ea0c66d5bdc807f97..2d51106273f035f02866bfbde0da20963b2058a6 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+sudo (1.6.9p17-3) stable-security; urgency=high
+
+  * Patch from Moritz Muehlenhoff fixing CVE-2010-1646, in which secure path
+    could be circumvented, closes: #585394
+
+ -- Bdale Garbee <bdale@gag.com>  Thu, 10 Jun 2010 17:30:33 -0600
+
 sudo (1.6.9p17-2+lenny1) stable-security; urgency=high
 
   * Non-maintainer upload by the Security Team.

diff --git a/env.c b/env.c
index d04186c2ee3b73035a61c62abed4c87681cac2c3..9b3f15d482081428c296c708dfc0c84f183593c0 100644 (file)
--- a/env.c
+++ b/env.c
@@ -275,6 +275,7 @@ insert_env(str, e, dupcheck)
 {
     char **nep;
     size_t varlen;
+    int found = FALSE;
 
     /* Make sure there is room for the new entry plus a NULL. */
     if (e->env_len + 2 > e->env_size) {
@@ -283,20 +284,34 @@ insert_env(str, e, dupcheck)
     }
 
     if (dupcheck) {
-           varlen = (strchr(str, '=') - str) + 1;
+       varlen = (strchr(str, '=') - str) + 1;
 
-           for (nep = e->envp; *nep; nep++) {
+       for (nep = e->envp; !found && *nep != NULL; nep++) {
+           if (strncmp(str, *nep, varlen) == 0) {
+               *nep = str;
+               found = TRUE;
+           }
+       }
+       /* Prune out duplicate variables. */
+       if (found) {
+           while (*nep != NULL) {
                if (strncmp(str, *nep, varlen) == 0) {
-                   *nep = str;
-                   return;
+                   memmove(nep, nep + 1,
+                       (e->env_len - (nep - e->envp)) * sizeof(char *));
+                   e->env_len--;
+               } else {
+                   nep++;
                }
            }
-    } else
-       nep = e->envp + e->env_len;
+       }
+    }
 
-    e->env_len++;
-    *nep++ = str;
-    *nep = NULL;
+    if (!found) {
+       nep = e->envp + e->env_len;
+       e->env_len++;
+       *nep++ = str;
+       *nep = NULL;
+    }
 }
 
 /*