debian bug 5898 - security option

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=5898

Yes, you read that right - an open bug with only a 4-digit ID.  9 years
and 236 days old.

> There should be an option to disable `dangerous' operations like
> writing files and executing programs, and another to disable reading
> files too.
>
> Dangerous builtins include (according to the Info page):
>    debugfile syscmd esyscmd sysval maketemp
>
>   File reading builtins include:
>    include sinclude

The idea might be nice for m4 2.0, but is not worth adding to the 1.4.x
branch.  My take on what a --secure option would disable:

debugfile (it can overwrite arbitrary existing files)
syscmd (it invokes arbitrary shell commands)
esyscmd (likewise)
maketemp (invoked enough times, it can form a denial-of-service by
creating lots of files)
builtin (at least, builtin on any of the restricted commands)

However, I see no reason to disable sysval (although it always results in
0 if you don't have [e]syscmd).  And I don't see how reading files can be
a security issue, since the person executing m4 can read those files from
the command line in the first place, so include, sinclude, and undivert

Re: m4 error message format

According to Bruno Haible on 7/31/2006 8:53 AM:
> Hi,
> 
> Recently on bug-gnulib you referred to the GNU standards for error message
> output. Today I got this error message from m4:
> 
> /packages/gnu/bin/m4: aclocal.m4: 851: Cannot open srcm4/absolute-header.m4: No such file or directory

Yes, that would be the bug I was trying to address in m4-1.4o/CVS head
when I brought up the issue on gnulib.  m4-1.4.x has a different bug,
where it prints "file:line: m4: message" (oops, it should have been
"m4:file:line: message").

I've been meaning to add something like verror_at_line(status, errnum,
file, line, format, va_list) to gnulib, and use that, rather than using a
homegrown program-name formatter; that would obsolete your proposed patch.
 But thanks for keeping me on my toes.

--
Life is short - so eat dessert first!

Eric Blake             ebb9 <at> byu.net

argument collection vs. tokens

This is an extreme corner case, so I'm asking here to get any feedback
before I try changing the behavior in 1.4.x.

When you use changecom or changequote to specify a start sequence that
begins with '(', macro.c currently uses peek_input() to see that the next
character is '(', then calls next_token() to discard the entire token.
However, next_token() gobbles the entire comment or quote, leading to
weird output (at least we can recover; when I tried this on Solaris, the
input engine gets stuck and claims that the entire rest of the file is an
unterminated quote or comment):

$ m4
define(echo,`$#:$ <at> ')changecom(`(',`)')dnl
echo(1,2)(3,4),5,6)
3:(3,4),5,6

My thoughts is that only input.c should be peeking at characters; macro.c
should only be concerned with tokens.  It would be better if we had a
function in input.c called peek_token() which determined if the next token
would be TOKEN_SIMPLE with contents '(' or not, so that the case above
would become:

$ m4
define(echo,`$#:$ <at> ')changecom(`(',`)')dnl
echo(1,2)(3,4),5,6)
0:(1,2)(3,4),5,6

Setting the start character to a single ( disables argument collection.
But it should be possible to use a multi-character quote or comment start,

Errors testing m4 1.4.5

# make check
[...]
Checking ./077.index_macro
Checking ./078.regexp
Checking ./079.regexp
 <at>  ../doc/m4.texinfo:3153: Origin of test
./079.regexp: stdout mismatch
2c2
<
---
 >
Checking ./080.substr
Checking ./081.translit
Checking ./082.patsubst
[...]
Checking ./102.extensions
Checking ./103.incompatibi
Checking ./104.answers

Failed checks were:
   ./079.regexp:out
make[1]: *** [check] Error 1
make[1]: Leaving directory `/tmp/m4-1.4.5/checks'
make: *** [check-recursive] Error 1

Re: Errors testing m4 1.4.5

According to Pierre on 8/7/2006 12:03 PM:
> ./079.regexp: stdout mismatch

Thanks for the report.

Already a well-known problem (actually, the problem existed pre-1.4.5, its
just that the testsuite now exposes it), and the first bug fixed in CVS
after 1.4.5 was released.  Look for 1.4.6 in the next week or two.

--
Life is short - so eat dessert first!

Eric Blake             ebb9 <at> byu.net

m4 updates

Can you please update the m4 domain page to have newer links?
http://www.iro.umontreal.ca/translation/registry.cgi?domain=m4

GNU site 	http://www.gnu.org/software/m4/
Project site 	http://savannah.gnu.org/projects/m4/
Mailing lists 	http://savannah.gnu.org/mail/?group=m4

The bug-m4 <at> gnu.org list is the best point of contact to reach the current
maintainers.

We hope to have a new alpha quality release in the next month or two, of
m4-1.9b, to give translators a leg up in preparation for the eventual
m4-2.0.  ftp://alpha.gnu.org/gnu/m4 will be the eventual home for this
alpha release; however, the latest release currently there, 1.4.4b, is not
gettext compatible.

--
Life is short - so eat dessert first!

Eric Blake             ebb9 <at> byu.net

Re: branch-1_4 debian bug 96075 - blind macros

According to Eric Blake on 7/31/2006 7:19 AM:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=96075 complains:
> 
>>> "format", "divert" and "shift" are all English words that
>>> might occur in text.  And they are all recognised without
>>> arguments - the default behaviour of m4 is to make these
>>> words disappear
> 
> 
> However, this patch will do what you request (as well as for errprint and
> m4wrap).  I will need some feedback before applying this patch to 1.4.6;
> otherwise, you will have to wait for m4 2.0.  Plus I would need to
> document the change in the .texinfo and NEWS.

I got no feedback, but decided to apply anyways.  Here is the patch I used:

2006-08-15  Eric Blake  <ebb9 <at> byu.net>

	* src/builtin.c (m4_m4wrap, m4_errprint, m4_shift): Make blind,
	per debian bug 96075.
	* doc/m4.texinfo (Loops, M4wrap, Errprint): Document this change.
	(Changeword): Don't use shift as an example of a swallowed word.
	(Divert): Discuss fact that divert is an English word.

--
Life is short - so eat dessert first!

Eric Blake             ebb9 <at> byu.net

Incorrect warning in 1.4.5 with regexp

According to the documentation a warning is issued if there are "fewer" 
sub-expressions than requested.   Unfortunately, the
newest version of gnu m4 has interpreted it to mean if any of the 
subexpressions evaluate to empty even when they are present in
the regular expression.   This seems like a bug.

 From the documentation:
"If replacement is supplied, and there was a match, regexp changes the 
expansion to this argument, with `\n' substituted by the text matched by 
the nth parenthesized sub-expression of regexp, up to nine sub-expressions. 
The escape `\&' is replaced by the text of the entire regular expression 
matched. For all other characters, `\' treats the next character literally. 
A warning is issued if there were fewer sub-expressions than the `\n' 
requested, or if there is a trailing `\'. If there was no match, regexp 
expands to the empty string. "

bug.m4:
regexp(`abc',`\([*&]\)?\(.*\)',`ifelse(\1,,Form 1 \1,Form 2 \2)')

[kenelson ~/]$ m4 bug.m4
bug.m4:1: m4: Warning: sub-expression 1 not present
bug.m4:1: m4: Warning: sub-expression 1 not present
Form 1

--Karl 

Bug in 1.4.5 with regexp

According to the documentation a warning is issued if there are "fewer" 
sub-expressions than requested.   Unfortunately, the
newest version of gnu m4 has interpreted it to mean if any of the 
subexpressions evaluate to empty even when they are present in
the regular expression.   This seems like a bug.

 From the documentation:
"If replacement is supplied, and there was a match, regexp changes the 
expansion to this argument, with `\n' substituted by the text matched by 
the nth parenthesized sub-expression of regexp, up to nine sub-expressions. 
The escape `\&' is replaced by the text of the entire regular expression 
matched. For all other characters, `\' treats the next character literally. 
A warning is issued if there were fewer sub-expressions than the `\n' 
requested, or if there is a trailing `\'. If there was no match, regexp 
expands to the empty string. "

bug.m4:
regexp(`abc',`\([*&]\)?\(.*\)',`ifelse(\1,,Form 1 \1,Form 2 \2)')

[kenelson ~/]$ m4 bug.m4
bug.m4:1: m4: Warning: sub-expression 1 not present
bug.m4:1: m4: Warning: sub-expression 1 not present
Form 1

--Karl

Solaris 10 make check problem for GNU m4-1.4.5

Hi Folks,

On Solaris 10, there are two problems with GNU m4-1.4.5.

  1) The generated Makefile has problems with a blank line in the middle
     of the .PHONY target list.
  2) The 082.patsubst check fails.

./082.patsubst: stdout mismatch
6c6
< GNUs NOT Unix
---
> GNUs NOT=04=f5x Unix

Where the =04 is a control-D character and the =f5 is a 0xf5 character.

	Thanks,
	-- Mark

% uname -a
SunOS robotron 5.10 Generic_118833-17 sun4u sparc SUNW,Sun-Fire-480R Solaris
% tar xzf m4-1.4.5.tar.gz && cd m4-1.4.5
% ./configure
checking for a BSD-compatible install... /usr/local/bin/install -c
checking whether build environment is sane... yes
checking for gawk... no
checking for mawk... no
checking for nawk... nawk