[LEDE-DEV] Patch FS#1181 - CVE-2017-16544: A Busybox autocompletion vulnerability

[TheWerthFam]

Date: Thu, 28 Dec 2017 10:32:09 -0500
Subject: [PATCH] In the add_match function in libbb/lineedit.c in BusyBox
  through 1.27.2, the tab autocomplete feature of the shell, used to get 
a list
  of filenames in a directory, does not sanitize filenames and results in
  executing any escape sequence in the terminal. This could potentially 
result
  in code execution, arbitrary file writes, or other attacks.

Fixes: FS#1181 - CVE-2017-16544:

Backport the patch from:
https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8
https://nvd.nist.gov/vuln/detail/CVE-2017-16544

Signed-off-by: Derek Werthmuller <thewerthfam at gmail.com>
---
  libbb/lineedit.c | 12 ++++++++++++
  1 file changed, 12 insertions(+)

diff --git a/libbb/lineedit.c b/libbb/lineedit.c
index 3e62f46..34538aa 100644
--- a/libbb/lineedit.c
+++ b/libbb/lineedit.c
@@ -632,6 +632,18 @@ static void free_tab_completion_data(void)

  static void add_match(char *matched)
  {
+    unsigned char *p = (unsigned char*)matched;
+    while (*p) {
+        /* ESC attack fix: drop any string with control chars */
+        if (*p < ' '
+         || (!ENABLE_UNICODE_SUPPORT && *p >= 0x7f)
+         || (ENABLE_UNICODE_SUPPORT && *p == 0x7f)
+        ) {
+            free(matched);
+            return;
+        }
+        p++;
+    }
      matches = xrealloc_vector(matches, 4, num_matches);
      matches[num_matches] = matched;
      num_matches++;
-- 
2.13.6