From aa5cbc4c13aad15463930c25777d0d6120d645ee Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Sep 05 2017 07:18:25 +0000
Subject: import bash-4.2.46-29.el7_4


---

diff --git a/SOURCES/bash-4.3-pipefd-leak.patch b/SOURCES/bash-4.3-pipefd-leak.patch
new file mode 100644
index 0000000..2885d2e
--- /dev/null
+++ b/SOURCES/bash-4.3-pipefd-leak.patch
@@ -0,0 +1,60 @@
+diff --git a/execute_cmd.c b/execute_cmd.c
+--- a/execute_cmd.c
++++ b/execute_cmd.c
+@@ -536,6 +536,10 @@ execute_command_internal (command, asynchronous, pipe_in, pipe_out,
+   REDIRECT *my_undo_list, *exec_undo_list;
+   volatile int last_pid;
+   volatile int save_line_number;
++#if defined (PROCESS_SUBSTITUTION)
++  volatile int ofifo, nfifo, osize, saved_fifo;
++  volatile char *ofifo_list = NULL;
++#endif
+ 
+ #if 0
+   if (command == 0 || breaking || continuing || read_but_dont_execute)
+@@ -681,6 +685,17 @@ execute_command_internal (command, asynchronous, pipe_in, pipe_out,
+   if (shell_control_structure (command->type) && command->redirects)
+     stdin_redir = stdin_redirects (command->redirects);
+ 
++#if defined (PROCESS_SUBSTITUTION)
++  if (variable_context != 0)
++    {
++      ofifo = num_fifos ();
++      ofifo_list = copy_fifo_list ((int*)&osize);
++      saved_fifo = 1;
++    }
++  else
++    saved_fifo = 0;
++#endif
++
+   /* Handle WHILE FOR CASE etc. with redirections.  (Also '&' input
+      redirection.)  */
+   if (do_redirections (command->redirects, RX_ACTIVE|RX_UNDOABLE) != 0)
+@@ -688,6 +703,9 @@ execute_command_internal (command, asynchronous, pipe_in, pipe_out,
+       cleanup_redirects (redirection_undo_list);
+       redirection_undo_list = (REDIRECT *)NULL;
+       dispose_exec_redirects ();
++#if defined (PROCESS_SUBSTITUTION)
++      free ((void*)ofifo_list);
++#endif
+       return (last_command_exit_value = EXECUTION_FAILURE);
+     }
+ 
+@@ -982,6 +1000,17 @@ execute_command_internal (command, asynchronous, pipe_in, pipe_out,
+   if (my_undo_list || exec_undo_list)
+     discard_unwind_frame ("loop_redirections");
+ 
++#if defined (PROCESS_SUBSTITUTION)
++  if (saved_fifo)
++    {
++      nfifo = num_fifos ();
++      if (nfifo > ofifo)
++       close_new_fifos ((char*)ofifo_list, osize);
++      free ((void*)ofifo_list);
++    }
++#endif
++
++
+   /* Invert the return value if we have to */
+   if (invert)
+     exec_result = (exec_result == EXECUTION_SUCCESS)
diff --git a/SPECS/bash.spec b/SPECS/bash.spec
index 8629605..9a6d496 100644
--- a/SPECS/bash.spec
+++ b/SPECS/bash.spec
@@ -6,7 +6,7 @@
 Version: %{baseversion}%{patchleveltag}
 Name: bash
 Summary: The GNU Bourne Again shell
-Release: 28%{?dist}
+Release: 29%{?dist}
 Group: System Environment/Shells
 License: GPLv3+
 Url: http://www.gnu.org/software/bash
@@ -189,6 +189,9 @@ Patch150: bash-4.3-cve-2016-7543.patch
 #1429838
 Patch151: bash-cve-2016-9401.patch
 
+#1473245
+Patch152: bash-4.3-pipefd-leak.patch
+
 BuildRequires: texinfo bison
 BuildRequires: ncurses-devel
 BuildRequires: autoconf, gettext
@@ -318,6 +321,7 @@ This package contains documentation files for %{name}.
 %patch149 -p1 -b .cve-2016-0634
 %patch150 -p1 -b .cve-2016-7543
 %patch151 -p1 -b .cve-2016-9401
+%patch152 -p1 -b .pipefd-leak
 
 echo %{version} > _distribution
 echo %{release} > _patchlevel
@@ -510,6 +514,10 @@ end
 #%doc doc/*.ps doc/*.0 doc/*.html doc/article.txt
 
 %changelog
+* Thu Aug 03 2017 Siteshwar Vashisht <svashisht@redhat.com> - 4.2.46-29
+- Fix a pipe fd leak in process substitution
+  Resolves: #1473245
+
 * Tue Mar 07 2017 Kamil Dudka <kdudka@redhat.com - 4.2.46-28
 - CVE-2016-9401 - Fix crash when '-' is passed as second sign to popd
   Resolves: #1429838