From: Xiangyu Chen <xiangyu.chen@...>

CVE Reference: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-3715

Signed-off-by: Xiangyu Chen <xiangyu.chen@...>
Signed-off-by: Steve Sakoman <steve@...>
---
.../bash/bash/CVE-2022-3715.patch | 33 +++++++++++++++++++
meta/recipes-extended/bash/bash_5.1.16.bb | 1 +
2 files changed, 34 insertions(+)
create mode 100644 meta/recipes-extended/bash/bash/CVE-2022-3715.patch

diff --git a/meta/recipes-extended/bash/bash/CVE-2022-3715.patch b/meta/recipes-extended/bash/bash/CVE-2022-3715.patch
new file mode 100644
index 0000000000..44f4d91949
--- /dev/null
+++ b/meta/recipes-extended/bash/bash/CVE-2022-3715.patch
@@ -0,0 +1,33 @@
+From 15d2428d5d3df8dd826008baf51579ab7750d8b2 Mon Sep 17 00:00:00 2001
+From: Xiangyu Chen <xiangyu.chen@...>
+Date: Wed, 23 Nov 2022 11:17:01 +0800
+Subject: [OE-Core][kirkstone][PATCH] bash: heap-buffer-overflow in
+ valid_parameter_transform CVE-2022-3715
+
+Reference:https://bugzilla.redhat.com/show_bug.cgi?id=2126720
+
+CVE: CVE-2022-3715
+Upstream-Status: Backport from
+[https://git.savannah.gnu.org/cgit/bash.git/diff/subst.c?h=bash-5.2-testing&id=9cef6d01181525de119832d2b6a925899cdec08e]
+
+Signed-off-by: Xiangyu Chen <xiangyu.chen@...>
+---
+ subst.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/subst.c b/subst.c
+index 2b76256..38ee9ac 100644
+--- a/subst.c
++++ b/subst.c
+@@ -7962,7 +7962,7 @@ parameter_brace_transform (varname, value, ind, xform, rtype, quoted, pflags, fl
+ return ((char *)NULL);
+ }
+
+- if (valid_parameter_transform (xform) == 0)
++ if (xform[0] == 0 || valid_parameter_transform (xform) == 0)
+ {
+ this_command_name = oname;
+ #if 0 /* TAG: bash-5.2 Martin Schulte <gnu@...> 10/2020 */
+--
+2.34.1
+
diff --git a/meta/recipes-extended/bash/bash_5.1.16.bb b/meta/recipes-extended/bash/bash_5.1.16.bb
index d046faa4e5..11c2314fbf 100644
--- a/meta/recipes-extended/bash/bash_5.1.16.bb
+++ b/meta/recipes-extended/bash/bash_5.1.16.bb
@@ -15,6 +15,7 @@ SRC_URI = "${GNU_MIRROR}/bash/${BP}.tar.gz;name=tarball \
file://use_aclocal.patch \
file://makerace.patch \
file://makerace2.patch \
+ file://CVE-2022-3715.patch \
"

SRC_URI[tarball.sha256sum] = "5bac17218d3911834520dad13cd1f85ab944e1c09ae1aba55906be1f8192f558"
--
2.25.1