2024-04-12 16:38:14

by Jakub Wilk

[permalink] [raw]
Subject: Re: [oss-security] Re: backdoor in upstream xz/liblzma leading to ssh server compromise

* Jonathan Schleifer <[email protected]>, 2024-03-30 17:17:
>I replaced the sed in here:
>
>sed \"r\n\" $gl_am_configmake | eval $gl_path_map |
>$gl_localedir_prefix -d 2>/dev/null
>
>With a simple cat, as I could not make sed work. This worries me as it
>means there is probably some other transformation that I'm missing that
>would have made the sed work.

It's confusing because there are two layers of eval involved. You
actually end up running:

sed rn ...

The "r" command means "read from file"; but there's no file named "n",
so this is no-op.

The sed command is not completely equivalent to cat though: it appends a
newline, because the original file didn't end with one. This trailing
garbage slightly upsets xz(1):

xz: (stdin): Unexpected end of input

(You normally wouldn't see this warning, thanks to generous use of
"2>/dev/null" in build-to-host.m4.)

--
Jakub Wilk