From d9730eca9d97926d22cd9ce1063913e185976c99 Mon Sep 17 00:00:00 2001
From: delphij <delphij@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Wed, 5 Aug 2015 22:05:18 +0000
Subject: [PATCH] Fix patch(1) shell injection vulnerability via ed(1).
 [SA-15:18]

Fix routed remote denial of service vulnerability. [SA-15:19]

Approved by:	so


git-svn-id: svn://svn.freebsd.org/base/releng/10.1@286351 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 UPDATING                  |  8 ++++++++
 sbin/routed/input.c       |  6 ++++++
 sys/conf/newvers.sh       |  2 +-
 usr.bin/patch/pathnames.h |  2 +-
 usr.bin/patch/pch.c       | 18 +++++++++++++++---
 5 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/UPDATING b/UPDATING
index e86bac05d..b21d80cc3 100644
--- a/UPDATING
+++ b/UPDATING
@@ -16,6 +16,14 @@ from older versions of FreeBSD, try WITHOUT_CLANG to bootstrap to the tip of
 stable/10, and then rebuild without this option. The bootstrap process from
 older version of current is a bit fragile.
 
+20150805:	p17	FreeBSD-SA-15:18.bsdpatch
+			FreeBSD-SA-15:19.routed
+
+	Fix patch(1) shell injection vulnerability via ed(1).
+	[SA-15:18]
+
+	Fix routed remote denial of service vulnerability. [SA-15:19]
+
 20150728:	p16	FreeBSD-SA-15:14.bsdpatch
 			FreeBSD-SA-15:15.tcp
 			FreeBSD-SA-15:16.openssh
diff --git a/sbin/routed/input.c b/sbin/routed/input.c
index aaef37c68..6fc5529ae 100644
--- a/sbin/routed/input.c
+++ b/sbin/routed/input.c
@@ -160,6 +160,12 @@ input(struct sockaddr_in *from,		/* received from this IP address */
 
 	trace_rip("Recv", "from", from, sifp, rip, cc);
 
+	if (sifp == 0) {
+		trace_pkt("    discard a request from an indirect router"
+		    " (possibly an attack)");
+		return;
+	}
+
 	if (rip->rip_vers == 0) {
 		msglim(&bad_router, FROM_NADDR,
 		       "RIP version 0, cmd %d, packet received from %s",
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 886aac693..cf7a83972 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="10.1"
-BRANCH="RELEASE-p16"
+BRANCH="RELEASE-p17"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi
diff --git a/usr.bin/patch/pathnames.h b/usr.bin/patch/pathnames.h
index d31300ea8..79d8faea6 100644
--- a/usr.bin/patch/pathnames.h
+++ b/usr.bin/patch/pathnames.h
@@ -9,4 +9,4 @@
 
 #include <paths.h>
 
-#define	_PATH_ED		"/bin/ed"
+#define	_PATH_RED		"/bin/red"
diff --git a/usr.bin/patch/pch.c b/usr.bin/patch/pch.c
index d9c4b3d0c..ccc913e56 100644
--- a/usr.bin/patch/pch.c
+++ b/usr.bin/patch/pch.c
@@ -1,4 +1,3 @@
-
 /*-
  * Copyright 1986, Larry Wall
  * 
@@ -1400,13 +1399,14 @@ do_ed_script(void)
 	char	*t;
 	long	beginning_of_this_line;
 	FILE	*pipefp = NULL;
+	int	continuation;
 
 	if (!skip_rest_of_patch) {
 		if (copy_file(filearg[0], TMPOUTNAME) < 0) {
 			unlink(TMPOUTNAME);
 			fatal("can't create temp file %s", TMPOUTNAME);
 		}
-		snprintf(buf, buf_size, "%s%s%s", _PATH_ED,
+		snprintf(buf, buf_size, "%s%s%s", _PATH_RED,
 		    verbose ? " " : " -s ", TMPOUTNAME);
 		pipefp = popen(buf, "w");
 	}
@@ -1424,7 +1424,19 @@ do_ed_script(void)
 		    *t == 'd' || *t == 'i' || *t == 's')) {
 			if (pipefp != NULL)
 				fputs(buf, pipefp);
-			if (*t != 'd') {
+			if (*t == 's') {
+				for (;;) {
+					continuation = 0;
+					t = strchr(buf, '\0') - 1;
+					while (--t >= buf && *t == '\\')
+						continuation = !continuation;
+					if (!continuation ||
+					    pgets(true) == 0)
+						break;
+					if (pipefp != NULL)
+						fputs(buf, pipefp);
+				}
+			} else if (*t != 'd') {
 				while (pgets(true)) {
 					p_input_line++;
 					if (pipefp != NULL)
-- 
2.42.0