I think I may have found a possible dos attack vector within bash.

2012-03-20 Thread Eamonn Smyth
Without sounding alarmist, I can break my machine using bash. I also have a fix. I shall be officially releasing the c code this weekend at the hackathon london. As my code following correctly implements the logic the dos attack vector is negated. The replacement code /*Do openql maths Now*/

Re: I think I may have found a possible dos attack vector within bash.

2012-03-20 Thread Greg Wooledge
On Tue, Mar 20, 2012 at 04:47:51PM +, Eamonn Smyth wrote: > Without sounding alarmist, I can break my machine using bash. I also have a > fix. I shall be officially releasing the c code this weekend at the > hackathon london. You included some C++ code (or possibly C code, if you're allowed to

Re: I think I may have found a possible dos attack vector within bash.

2012-03-20 Thread dethrophes
Am 20.03.2012 17:47, schrieb Eamonn Smyth: Without sounding alarmist, I can break my machine using bash. I also have a fix. I shall be officially releasing the c code this weekend at the hackathon london. As my code following correctly implements the logic the dos attack vector is negated. The

Re: I think I may have found a possible dos attack vector within bash.

2012-03-20 Thread dethrophes
Am 20.03.2012 18:04, schrieb Greg Wooledge: On Tue, Mar 20, 2012 at 04:47:51PM +, Eamonn Smyth wrote: Without sounding alarmist, I can break my machine using bash. I also have a fix. I shall be officially releasing the c code this weekend at the hackathon london. You included some C++ code

Re: I think I may have found a possible dos attack vector within bash.

2012-03-20 Thread Greg Wooledge
On Tue, Mar 20, 2012 at 06:47:17PM +0100, dethrophes wrote: > Secondly when you say dos? you mean a windows command prompt or you > actually mean DOS 6.22, dosbox, or a text box what do you consider dos?. He meant DoS, or "Denial of Service". He believes he has found some sort of security bug/ex

Re: I think I may have found a possible dos attack vector within bash.

2012-03-20 Thread dethrophes
Thanks Greg that makes more sense. I would have recognised DoS, dos though :) showing my age I guess. I'm inclined to doubt though that it can be defined as a Bash DoS whatever it is, otherwise a lot of installation/bash scripts would be up for the chop ;). Am 20.03.2012 19:00, schrieb Greg W

Re: I think I may have found a possible dos attack vector within bash.

2012-03-20 Thread Stephane Chazelas
2012-03-20 16:47:51 +, Eamonn Smyth: > Without sounding alarmist, I can break my machine using bash. I also have a > fix. I shall be officially releasing the c code this weekend at the > hackathon london. [...] A DOS vector often found is bash *scripts* is when a script takes user input in a v

Re: I think I may have found a possible dos attack vector within bash.

2012-03-20 Thread Chet Ramey
On 3/20/12 2:17 PM, Stephane Chazelas wrote: > 2012-03-20 16:47:51 +, Eamonn Smyth: >> Without sounding alarmist, I can break my machine using bash. I also have a >> fix. I shall be officially releasing the c code this weekend at the >> hackathon london. > [...] > > A DOS vector often found is

Re: Bug in nested parameter expansion.

2012-03-20 Thread Chet Ramey
On 3/19/12 9:27 AM, Mark Edgar wrote: > I've boiled the problem down to this: > > A= > B=q > echo "x${A+${B#q*}}x" | sed -nel > > Excluding the newline, the output I expect is "xx", but instead there > is a delete character \177 between the two "x" characters. Thanks for the wonderfully detai

$RANDOM and here-string and here-doc

2012-03-20 Thread Jurij Mihelič
Configuration Information [Automatically generated, do not change]: Machine: i686 OS: linux-gnu Compiler: gcc Compilation CFLAGS: -DPROGRAM='bash' -DCONF_HOSTTYPE='i686' -DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i686-pc-linux-gnu' -DC$ uname output: Linux lalgec 3.0.0-16-generic-pae #29-Ubuntu S

which file in bash source code (tarball) contain a print output function

2012-03-20 Thread runicer
I have bash-4.2.tar.gz What inside this, All source code .c/.h , configuration file. I want to find where is the print standard output function and add my script like sed 's,Hello,Hi,gI'before it printed. The result will be every standard output with the hello word will change to Hi word. -- View

Re: which file in bash source code (tarball) contain a print output function

2012-03-20 Thread dethrophes
not sure if its what your looking for but you could look at builtins/printf.def as a starting point. it implements the printf builtin function. Am 20.03.2012 20:29, schrieb runicer: I have bash-4.2.tar.gz What inside this, All source code .c/.h , configuration file. I want to find where is the

Re: $RANDOM and here-string and here-doc

2012-03-20 Thread Chet Ramey
On 3/20/12 12:37 PM, Jurij Mihelič wrote: > Configuration Information [Automatically generated, do not change]: > Machine: i686 > OS: linux-gnu > Compiler: gcc > Compilation CFLAGS: -DPROGRAM='bash' -DCONF_HOSTTYPE='i686' > -DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i686-pc-linux-gnu' -DC$ > unam