Document

apache "WIN32/OS2 shell characters not escaped correctly when cross-compiling

The define NEED_ENHANCED_ESCAPES needs to be used for WIN32 or OS2 operating systems, regardless if the whole apache httpd is cross-compiled or not. The utility gen_test_char generates the header file test_char.h, which defines a table test_char_table that is used to escape special characters, for instance, in shell command strings. If the special WIN32/OS2 characters \r and % are not escaped correctly, this could potentially be exploited."

Bug fixed by commit c76df14dfb4

Type	OSCommandInjection
Config	"CROSS_COMPILE && (WIN32 \|\| OS2)" (2nd degree)
Fix-in	mapping
Location	server/

#include <stdio.h>
#include <string.h>

#define T_ESCAPE_SHELL_CMD (0x01)

#ifdef CROSS_COMPILE
#define APR_HAVE_STDIO_H 1
#else
#include <stdlib.h> //apr-related headers
#if defined(WIN32) || defined(OS2)
#define NEED_ENHANCED_ESCAPES
#endif
#endif

int main(void)
{
  unsigned c = 0;
  unsigned char flags;
    
  for (c = 0; c < 256; ++c) {
    flags = 0;
    if (c % 20 == 0)
      printf("\n    ");

        /* escape_shell_cmd */
#ifdef NEED_ENHANCED_ESCAPES
        /* Win32/OS2 have many of the same vulnerable characters
         * as Unix sh, plus the carriage return and percent char.
         * The proper escaping of these characters varies from unix
         * since Win32/OS2 use carets or doubled-double quotes,
         * and neither lf nor cr can be escaped.  We escape unix
         * specific as well, to assure that cross-compiled unix
         * applications behave similiarly when invoked on win32/os2.
         *
         * Rem please keep in-sync with apr's list in win32/filesys.c
         */
      if (c && strchr("&;`'\"|*?~<>^()[]{}$\\\n\r%", c)) {
        flags |= T_ESCAPE_SHELL_CMD;
      }
#else
      if (c && strchr("&;`'\"|*?~<>^()[]{}$\\\n", c)) {
        flags |= T_ESCAPE_SHELL_CMD;
      }
#endif
  }
  return 0;
}

diff --git a/apache/simple/c76df14.c b/apache/simple/c76df14.c
--- a/apache/simple/c76df14.c
+++ b/apache/simple/c76df14.c
@@ -7,10 +7,11 @@
 #define APR_HAVE_STDIO_H 1
 #else
 #include <stdlib.h> //apr-related headers
+#endif
+
 #if defined(WIN32) || defined(OS2)
 #define NEED_ENHANCED_ESCAPES
 #endif
-#endif
 
 int main(void)
 {

. server/gen_test_char.c:17: #ifdef CROSS_COMPILE
. // NEED_ENHANCED_ESCAPES will not be defined by server/gen_test_char.c:35
. // Special WIN32/OS2 shell characters will not be escaped !!!
. ERROR server/gen_test_char.c:101: if (c && strchr("&;`'\"|*?~<>^()[]{}$\\\n", c)) {