Package: emacs;
Reported by: Stefan Monnier <monnier <at> IRO.UMontreal.CA>
Date: Wed, 23 Jan 2019 16:09:02 UTC
Severity: important
Tags: security
Found in version 27.0.50
Fixed in version 28.1
Done: Lars Ingebrigtsen <larsi <at> gnus.org>
Bug is archived. No further changes may be made.
Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):
From: Stefan Monnier <monnier <at> IRO.UMontreal.CA> To: bug-gnu-emacs <at> gnu.org Subject: 27.0.50; argv[0] used incorrectly to find the .pdmp Date: Wed, 23 Jan 2019 11:07:51 -0500
Package: Emacs Version: 27.0.50 Currently, the first .pdmp file that we try to load is found by adding ".pdmp" to argv[0]. This has 2 problems: 1- It fails miserably if argv[0] is a name relative to $PATH since it performs the lookup relative to $PWD instead, which is additionally a security issue. 2- If the executable named by argv[0] is a symlink, it does not try to follow the symlink in case the .pdmp is stored next to the destination rather than next to the source. -- Stefan In GNU Emacs 27.0.50 (build 1, x86_64-unknown-linux-gnu, GTK+ Version 3.24.3) of 2019-01-22 built on alfajor Repository revision: 4e56ca18c9760d9a9429d71e36bedfe4da879a9c Repository branch: work Windowing system distributor 'The X.Org Foundation', version 11.0.12003000 System Description: Debian GNU/Linux buster/sid Recent messages: Mark set Auto-saving...done Saving file /home/monnier/src/emacs/trunk/src/emacs.c... Wrote /home/monnier/src/emacs/trunk/src/emacs.c Saving file /home/monnier/src/emacs/trunk/ChangeLog... Wrote /home/monnier/src/emacs/trunk/ChangeLog Mark set Press C-c C-c when you are done editing. Enter a change comment. Type C-c C-c when done Checking in /home/monnier/src/emacs/trunk/src/emacs.c...done Configured using: 'configure -C --enable-checking --with-modules --enable-check-lisp-object-type 'CFLAGS=-Wall -g3 -Og -Wno-pointer-sign' PKG_CONFIG_PATH=/home/monnier/lib/pkgconfig' Configured features: XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS GSETTINGS GLIB NOTIFY INOTIFY GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB TOOLKIT_SCROLL_BARS GTK3 X11 XDBE XIM MODULES THREADS CANNOT_DUMP LCMS2 GMP Important settings: value of $LANG: fr_CH.UTF-8 locale-coding-system: utf-8-unix Major mode: InactiveMinibuffer Minor modes in effect: c-electric-flag: t shell-dirtrack-mode: t diff-auto-refine-mode: t electric-pair-mode: t global-reveal-mode: t reveal-mode: t auto-insert-mode: t savehist-mode: t minibuffer-electric-default-mode: t global-compact-docstrings-mode: t url-handler-mode: t global-eldoc-mode: t electric-indent-mode: t mouse-wheel-mode: t global-prettify-symbols-mode: t menu-bar-mode: t file-name-shadow-mode: t global-font-lock-mode: t line-number-mode: t transient-mark-mode: t auto-composition-mode: t auto-encryption-mode: t auto-compression-mode: t Load-path shadows: /home/monnier/src/emacs/elpa/packages/svg/svg hides /home/monnier/src/emacs/work/lisp/svg /home/monnier/src/emacs/elpa/packages/ada-mode/ada-mode hides /home/monnier/src/emacs/work/lisp/progmodes/ada-mode /home/monnier/src/emacs/elpa/packages/ada-mode/ada-stmt hides /home/monnier/src/emacs/work/lisp/progmodes/ada-stmt /home/monnier/src/emacs/elpa/packages/ada-mode/ada-prj hides /home/monnier/src/emacs/work/lisp/progmodes/ada-prj /home/monnier/src/emacs/elpa/packages/ada-mode/ada-xref hides /home/monnier/src/emacs/work/lisp/progmodes/ada-xref /home/monnier/src/emacs/elpa/packages/nadvice/nadvice hides /home/monnier/src/emacs/work/lisp/emacs-lisp/nadvice /home/monnier/src/emacs/elpa/packages/hyperbole/set hides /home/monnier/src/emacs/work/lisp/emacs-lisp/set /home/monnier/src/emacs/elpa/packages/landmark/landmark hides /home/monnier/src/emacs/work/lisp/obsolete/landmark /home/monnier/src/emacs/elpa/packages/crisp/crisp hides /home/monnier/src/emacs/work/lisp/obsolete/crisp Features: (sort mail-extr emacsbug log-edit message sendmail rmc puny dired dired-loaddefs format-spec rfc822 mml mml-sec epa derived epg gnus-util rmail rmail-loaddefs time-date mm-decode mm-bodies mm-encode mail-parse rfc2231 rfc2047 rfc2045 mm-util ietf-drums mail-prsvr mailabbrev mail-utils mailheader pcvs-util bug-reference add-log smerge-mode whitespace vc vc-dispatcher make-mode pulse cc-mode cc-fonts cc-guess cc-menus cc-cmds cc-styles cc-align cc-engine cc-langs cc-vars cc-defs etags multifile generator xref project shell pcomplete grep cl-print cl-extra help-fns radix-tree sm-c-mode smie misearch multi-isearch lisp-mnt xscheme byte-opt unsafep trace testcover shadow scheme re-builder profiler inf-lisp ielm gmm-utils ert pp ewoc debug elp edebug backtrace find-func cl-indent advice cus-edit cus-start cus-load wid-edit executable copyright view cal-china lunar solar cal-dst cal-bahai cal-islam cal-hebrew holidays hol-loaddefs cal-french vc-git diff-mode filecache diary-lib diary-loaddefs cal-move cal-menu calendar cal-loaddefs server flymake-proc flymake compile comint ansi-color ring warnings noutline outline easy-mmode flyspell ispell checkdoc thingatpt help-mode load-dir elec-pair reveal autoinsert savehist minibuf-eldef disp-table compact-docstrings cl-seq inline kotl-autoloads proof-site proof-autoloads realgud-recursive-autoloads finder-inf url-auth info package easymenu epg-config url-handlers url-parse auth-source eieio eieio-core cl-macs gv eieio-loaddefs password-cache json map url-vars seq bytecomp byte-compile cconv cl-loaddefs cl-lib mule-util tooltip eldoc electric uniquify ediff-hook vc-hooks lisp-float-type mwheel term/x-win x-win term/common-win x-dnd tool-bar dnd fontset image regexp-opt fringe tabulated-list replace newcomment text-mode elisp-mode lisp-mode prog-mode register page menu-bar rfn-eshadow isearch timer select scroll-bar mouse jit-lock font-lock syntax font-core term/tty-colors frame simple minibuffer cl-generic cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european ethiopic indian cyrillic chinese composite charscript charprop case-table epa-hook jka-cmpr-hook help abbrev obarray cl-preloaded nadvice loaddefs button faces cus-face macroexp files text-properties overlay sha1 md5 base64 format env code-pages mule custom widget hashtable-print-readable backquote threads dbusbind inotify lcms2 dynamic-setting system-font-setting font-render-setting move-toolbar gtk x-toolkit x multi-tty make-network-process emacs) Memory information: ((conses 8 239985 30547) (symbols 24 18919 0) (strings 16 72751 4613) (string-bytes 1 2323909) (vectors 8 43743) (vector-slots 4 1324674 45672) (floats 8 584 263) (intervals 28 6233 0) (buffers 528 39))
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.