From unknown Thu Sep 11 06:33:30 2025 X-Loop: help-debbugs@gnu.org Subject: bug#22856: "make check" can start a shell on binary data Resent-From: Vincent Lefevre Original-Sender: "Debbugs-submit" Resent-CC: bug-automake@gnu.org Resent-Date: Mon, 29 Feb 2016 19:01:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 22856 X-GNU-PR-Package: automake X-GNU-PR-Keywords: To: 22856@debbugs.gnu.org X-Debbugs-Original-To: bug-automake@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.145677240614052 (code B ref -1); Mon, 29 Feb 2016 19:01:02 +0000 Received: (at submit) by debbugs.gnu.org; 29 Feb 2016 19:00:06 +0000 Received: from localhost ([127.0.0.1]:54027 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aaT38-0003ea-Al for submit@debbugs.gnu.org; Mon, 29 Feb 2016 14:00:06 -0500 Received: from eggs.gnu.org ([208.118.235.92]:45470) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aaT35-0003co-6c for submit@debbugs.gnu.org; Mon, 29 Feb 2016 14:00:04 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aaT2y-0004LR-Vw for submit@debbugs.gnu.org; Mon, 29 Feb 2016 13:59:58 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50 autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:33963) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aaT2y-0004LN-Lz for submit@debbugs.gnu.org; Mon, 29 Feb 2016 13:59:56 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36436) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aaT2x-00010q-ES for bug-automake@gnu.org; Mon, 29 Feb 2016 13:59:56 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aaT2s-0004Ks-DB for bug-automake@gnu.org; Mon, 29 Feb 2016 13:59:55 -0500 Received: from ioooi.vinc17.net ([92.243.22.117]:41061) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aaT2s-0004Kl-6M for bug-automake@gnu.org; Mon, 29 Feb 2016 13:59:50 -0500 Received: from smtp-zira.vinc17.net (128.119.75.86.rev.sfr.net [86.75.119.128]) by ioooi.vinc17.net (Postfix) with ESMTPSA id DD21E43C; Mon, 29 Feb 2016 19:59:48 +0100 (CET) Received: by zira.vinc17.org (Postfix, from userid 1000) id C182BC203CA; Mon, 29 Feb 2016 19:59:47 +0100 (CET) Date: Mon, 29 Feb 2016 19:59:47 +0100 From: Vincent Lefevre Message-ID: <20160229185947.GM31013@zira.vinc17.org> Mail-Followup-To: Vincent Lefevre , bug-automake@gnu.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline X-Mailer-Info: https://www.vinc17.net/mutt/ User-Agent: Mutt/1.5.24-6559-vl-r83103 (2016-02-15) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -5.0 (-----) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) When I cross-compile for Windows and run "make check" without LOG_COMPILER=3Dwine (by mistake), strange files appear. For instance, as a simple example with MPFR: cventin:...re/mpfr-3.1/tests> make tadd.log FAIL: tadd.exe The failure is expected, but I get: -rw-r--r-- 1 491 2016-02-29 19:39:24 tadd.log -rw-r--r-- 1 84 2016-02-29 19:39:24 tadd.trs -rw-r--r-- 1 0 2016-02-29 19:39:24 \220\324V\366 Created files like "\220\324V\366" are very annoying. In particular, they make svn unusable. tadd.log contains: ./tadd.exe: 1: ./tadd.exe: MZ=C2=90=EF=BF=BD=EF=BF=BD=C2=B8@=C2=80=C2=BA=C2= =B4: not found ./tadd.exe: 2: ./tadd.exe: : not found ./tadd.exe: 1: ./tadd.exe: @.bss=C2=A0=C2=80: not found ./tadd.exe: 1: ./tadd.exe: .textd*,: not found ./tadd.exe: 3: ./tadd.exe: JPL2@=EF=BF=BD.idata: not found ./tadd.exe: 3: ./tadd.exe: =C2=96u : not found ./tadd.exe: 4: ./tadd.exe: ~@0=EF=BF=BD.CRT4=EF=BF=BD=C2=88@0=EF=BF=BD.tl= s: not found ./tadd.exe: 5: ./tadd.exe: @B/81P: not found ./tadd.exe: 13: ./tadd.exe: Syntax error: Missing '}' FAIL tadd.exe (exit status: 2) So, it appears that tadd.exe (which is a binary[*]) was executed by a shell! [*] $ file tadd.exe tadd.exe: PE32 executable (console) Intel 80386, for MS Windows This is confirmed by strace: [...] 10517 execve("./tadd.exe", ["./tadd.exe"], [/* 116 vars */]) =3D -1 ENOEX= EC (Exec format error) 10517 execve("/bin/sh", ["/bin/sh", "./tadd.exe"], [/* 116 vars */]) =3D = 0 [...] Concerning the Makefile in the tests: # Makefile.in generated by automake 1.15 from Makefile.am. # tests/Makefile. Generated from Makefile.in by configure. This is under Debian/unstable. --=20 Vincent Lef=C3=A8vre - Web: 100% accessible validated (X)HTML - Blog: Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon) From unknown Thu Sep 11 06:33:30 2025 MIME-Version: 1.0 X-Mailer: MIME-tools 5.505 (Entity 5.505) X-Loop: help-debbugs@gnu.org From: help-debbugs@gnu.org (GNU bug Tracking System) To: Vincent Lefevre Subject: bug#22856: closed (Re: "make check" can start a shell on binary data) Message-ID: References: <20160229190347.GN31013@zira.vinc17.org> <20160229185947.GM31013@zira.vinc17.org> X-Gnu-PR-Message: they-closed 22856 X-Gnu-PR-Package: automake Reply-To: 22856@debbugs.gnu.org Date: Mon, 29 Feb 2016 19:04:02 +0000 Content-Type: multipart/mixed; boundary="----------=_1456772642-14429-1" This is a multi-part message in MIME format... ------------=_1456772642-14429-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Your bug report #22856: "make check" can start a shell on binary data which was filed against the automake package, has been closed. The explanation is attached below, along with your original report. If you require more details, please reply to 22856@debbugs.gnu.org. --=20 22856: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D22856 GNU Bug Tracking System Contact help-debbugs@gnu.org with problems ------------=_1456772642-14429-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at 22856-done) by debbugs.gnu.org; 29 Feb 2016 19:03:50 +0000 Received: from localhost ([127.0.0.1]:54034 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aaT6j-0003kL-TG for submit@debbugs.gnu.org; Mon, 29 Feb 2016 14:03:50 -0500 Received: from ioooi.vinc17.net ([92.243.22.117]:59428) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aaT6i-0003kD-Ni for 22856-done@debbugs.gnu.org; Mon, 29 Feb 2016 14:03:49 -0500 Received: from smtp-zira.vinc17.net (128.119.75.86.rev.sfr.net [86.75.119.128]) by ioooi.vinc17.net (Postfix) with ESMTPSA id 9B24443C; Mon, 29 Feb 2016 20:03:47 +0100 (CET) Received: by zira.vinc17.org (Postfix, from userid 1000) id 72C73C203CA; Mon, 29 Feb 2016 20:03:47 +0100 (CET) Date: Mon, 29 Feb 2016 20:03:47 +0100 From: Vincent Lefevre To: 22856-done@debbugs.gnu.org Subject: Re: "make check" can start a shell on binary data Message-ID: <20160229190347.GN31013@zira.vinc17.org> References: <20160229185947.GM31013@zira.vinc17.org> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20160229185947.GM31013@zira.vinc17.org> X-Mailer-Info: https://www.vinc17.net/mutt/ User-Agent: Mutt/1.5.24-6559-vl-r83103 (2016-02-15) X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 22856-done X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.0 (/) Sorry, forget this bug report. After wondering where the problem came from exactly, I've eventually found that this is some incredible bug in dash! -- Vincent Lefèvre - Web: 100% accessible validated (X)HTML - Blog: Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon) ------------=_1456772642-14429-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at submit) by debbugs.gnu.org; 29 Feb 2016 19:00:06 +0000 Received: from localhost ([127.0.0.1]:54027 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aaT38-0003ea-Al for submit@debbugs.gnu.org; Mon, 29 Feb 2016 14:00:06 -0500 Received: from eggs.gnu.org ([208.118.235.92]:45470) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aaT35-0003co-6c for submit@debbugs.gnu.org; Mon, 29 Feb 2016 14:00:04 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aaT2y-0004LR-Vw for submit@debbugs.gnu.org; Mon, 29 Feb 2016 13:59:58 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50 autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:33963) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aaT2y-0004LN-Lz for submit@debbugs.gnu.org; Mon, 29 Feb 2016 13:59:56 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36436) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aaT2x-00010q-ES for bug-automake@gnu.org; Mon, 29 Feb 2016 13:59:56 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aaT2s-0004Ks-DB for bug-automake@gnu.org; Mon, 29 Feb 2016 13:59:55 -0500 Received: from ioooi.vinc17.net ([92.243.22.117]:41061) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aaT2s-0004Kl-6M for bug-automake@gnu.org; Mon, 29 Feb 2016 13:59:50 -0500 Received: from smtp-zira.vinc17.net (128.119.75.86.rev.sfr.net [86.75.119.128]) by ioooi.vinc17.net (Postfix) with ESMTPSA id DD21E43C; Mon, 29 Feb 2016 19:59:48 +0100 (CET) Received: by zira.vinc17.org (Postfix, from userid 1000) id C182BC203CA; Mon, 29 Feb 2016 19:59:47 +0100 (CET) Date: Mon, 29 Feb 2016 19:59:47 +0100 From: Vincent Lefevre To: bug-automake@gnu.org Subject: "make check" can start a shell on binary data Message-ID: <20160229185947.GM31013@zira.vinc17.org> Mail-Followup-To: Vincent Lefevre , bug-automake@gnu.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline X-Mailer-Info: https://www.vinc17.net/mutt/ User-Agent: Mutt/1.5.24-6559-vl-r83103 (2016-02-15) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) When I cross-compile for Windows and run "make check" without LOG_COMPILER=3Dwine (by mistake), strange files appear. For instance, as a simple example with MPFR: cventin:...re/mpfr-3.1/tests> make tadd.log FAIL: tadd.exe The failure is expected, but I get: -rw-r--r-- 1 491 2016-02-29 19:39:24 tadd.log -rw-r--r-- 1 84 2016-02-29 19:39:24 tadd.trs -rw-r--r-- 1 0 2016-02-29 19:39:24 \220\324V\366 Created files like "\220\324V\366" are very annoying. In particular, they make svn unusable. tadd.log contains: ./tadd.exe: 1: ./tadd.exe: MZ=C2=90=EF=BF=BD=EF=BF=BD=C2=B8@=C2=80=C2=BA=C2= =B4: not found ./tadd.exe: 2: ./tadd.exe: : not found ./tadd.exe: 1: ./tadd.exe: @.bss=C2=A0=C2=80: not found ./tadd.exe: 1: ./tadd.exe: .textd*,: not found ./tadd.exe: 3: ./tadd.exe: JPL2@=EF=BF=BD.idata: not found ./tadd.exe: 3: ./tadd.exe: =C2=96u : not found ./tadd.exe: 4: ./tadd.exe: ~@0=EF=BF=BD.CRT4=EF=BF=BD=C2=88@0=EF=BF=BD.tl= s: not found ./tadd.exe: 5: ./tadd.exe: @B/81P: not found ./tadd.exe: 13: ./tadd.exe: Syntax error: Missing '}' FAIL tadd.exe (exit status: 2) So, it appears that tadd.exe (which is a binary[*]) was executed by a shell! [*] $ file tadd.exe tadd.exe: PE32 executable (console) Intel 80386, for MS Windows This is confirmed by strace: [...] 10517 execve("./tadd.exe", ["./tadd.exe"], [/* 116 vars */]) =3D -1 ENOEX= EC (Exec format error) 10517 execve("/bin/sh", ["/bin/sh", "./tadd.exe"], [/* 116 vars */]) =3D = 0 [...] Concerning the Makefile in the tests: # Makefile.in generated by automake 1.15 from Makefile.am. # tests/Makefile. Generated from Makefile.in by configure. This is under Debian/unstable. --=20 Vincent Lef=C3=A8vre - Web: 100% accessible validated (X)HTML - Blog: Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon) ------------=_1456772642-14429-1-- From unknown Thu Sep 11 06:33:30 2025 X-Loop: help-debbugs@gnu.org Subject: bug#22856: "make check" can start a shell on binary data Resent-From: Nick Bowler Original-Sender: "Debbugs-submit" Resent-CC: bug-automake@gnu.org Resent-Date: Mon, 29 Feb 2016 19:49:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 22856 X-GNU-PR-Package: automake X-GNU-PR-Keywords: To: 22856@debbugs.gnu.org, vincent@vinc17.net Cc: 22856-done@debbugs.gnu.org Received: via spool by 22856-submit@debbugs.gnu.org id=B22856.145677529818494 (code B ref 22856); Mon, 29 Feb 2016 19:49:02 +0000 Received: (at 22856) by debbugs.gnu.org; 29 Feb 2016 19:48:18 +0000 Received: from localhost ([127.0.0.1]:54075 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aaTnm-0004o9-Jc for submit@debbugs.gnu.org; Mon, 29 Feb 2016 14:48:18 -0500 Received: from mail-oi0-f51.google.com ([209.85.218.51]:33513) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aaTnl-0004np-0e for 22856@debbugs.gnu.org; Mon, 29 Feb 2016 14:48:17 -0500 Received: by mail-oi0-f51.google.com with SMTP id d205so30267266oia.0 for <22856@debbugs.gnu.org>; Mon, 29 Feb 2016 11:48:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=draconx-ca.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-transfer-encoding; bh=MtGzbwpcli3UvHfFkP4xD9V+Qbqbt5G3aAkhvXgvfwM=; b=ctcGTu2BNXfHTQTi7BSbc/pgL5VLEF58VUU7jd4oRfnwImkNpuWtSFCWPkAaxJYA+U GO5gLc2Z29azV5cTZ1aPjvZLFS3By00UGBaOXRhI41GNs0l/6CVygIHK+yAylhc7Bp/S 4hqjitWa0BP8Li+hrNmKoDVmokPixLlp2WBXEkAkBrokqT+C4PvFEPth8IhPhO6nHDOs 6IABLoELyPeNzuqzumLsSh/Xa8dC+VrMfNSfrZ7EbTmZnhhZXDj24U45TX4EDR47Q3VF aZ6HeOIHnDB48lRbIjXiBroYwoauP8RCJDn4F8njZasRu0d0PnmSb/5XVOOINO73bxc6 Evfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-transfer-encoding; bh=MtGzbwpcli3UvHfFkP4xD9V+Qbqbt5G3aAkhvXgvfwM=; b=fLDCENATfKWNinBL14wMLB3gfj4GyPDARcjlCn3WlIadVi6QsRHHY71XhQQFVPrrMP y26a+Sd6xKhzzdKbHm8csyXoSr4IyGSccy9uxZ2HjYHou8vVJ4Eoxxjj0HsCT2aSCj8r ExsXSePc317HDB9Y3pCddFaEIIlwd+B0Sbhx0+9uv9C7nq55KzgNjl+0F6LH8iyfpeJa yxudzDRckXZM9KPmVi8C3ke54ly5LTpZMddZjVlQwfFdCVTtMd2ENm8CyXg3UxZM5t1c HkoXe9YOBJq7zWNyr1a2EezgII3NF47d5woijevVKSXgvy15wVG1KXpdAleA+sTZFEZj W0pQ== X-Gm-Message-State: AD7BkJK2Iwkpe+LCazYK9unuDDCzrUGm3JTTOC4Zhz/888pvUIaahzzCpP7QO2wL/EupLeA8o1G/DzcfKMm5Hg== MIME-Version: 1.0 X-Received: by 10.202.73.214 with SMTP id w205mr7512003oia.20.1456775291311; Mon, 29 Feb 2016 11:48:11 -0800 (PST) Received: by 10.202.229.143 with HTTP; Mon, 29 Feb 2016 11:48:11 -0800 (PST) X-Originating-IP: [50.21.174.4] In-Reply-To: <20160229190347.GN31013@zira.vinc17.org> References: <20160229185947.GM31013@zira.vinc17.org> <20160229190347.GN31013@zira.vinc17.org> Date: Mon, 29 Feb 2016 14:48:11 -0500 Message-ID: From: Nick Bowler Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) On 2016-02-29, Vincent Lefevre wrote: > When I cross-compile for Windows and run "make check" without > LOG_COMPILER=3Dwine (by mistake), strange files appear. [...] > ./tadd.exe: 1: ./tadd.exe: MZ =EF=BF=BD=EF=BF=BD=C2=B8@=E2=82=AC=C2=BA=C2= =B4: not found > ./tadd.exe: 2: ./tadd.exe: : not found > ./tadd.exe: 1: ./tadd.exe: @.bss =E2=82=AC: not found > ./tadd.exe: 1: ./tadd.exe: .textd*,: not found > ./tadd.exe: 3: ./tadd.exe: JPL2@=EF=BF=BD.idata: not found [...] > So, it appears that tadd.exe (which is a binary[*]) was executed > by a shell! [...] > 10517 execve("./tadd.exe", ["./tadd.exe"], [/* 116 vars */]) =3D -1 ENOEX= EC > (Exec format error) > 10517 execve("/bin/sh", ["/bin/sh", "./tadd.exe"], [/* 116 vars */]) =3D = 0 Later on 2016-02-29, Vincent Lefevre wrote: > Sorry, forget this bug report. After wondering where the problem came > from exactly, I've eventually found that this is some incredible bug > in dash! This crazy behaviour is actually permitted by POSIX, and to a certain extent is even mandatory. When executing a command whose name contains a slash: "If the execl() function fails due to an error equivalent to the [ENOEXEC] error, the shell shall execute a command equivalent to having a shell invoked with the command name as its first operand, with any remaining arguments passed to the new shell. If the executable file is not a text file, the shell may bypass this command execution." (The text for commands without a slash is similar). In POSIX text files are permitted to contain bytes with any value other than 0 (NUL), so all sorts of line noise counts and is required to be executed as a shell script. But since the check is optional dash might just not bother doing it, or maybe does not look at the entire file. Cheers, Nick