alpine 3.6
shell weakness #46


Weakness Breakdown


A shell weakness occurs when a program enables an attacker to execute unexpected commands on the operating system.

Warning code(s):

This causes a new program to execute and is difficult to use safely.

File Name:



The highlighted line of code below is the trigger point of this particular Alpine 3.6 shell weakness.

 #ifndef CRTL_VER_V731
/* getpgrp() -- there's no such thing as process group under VMS;
 *		job tree might be close enough to be useful though.
int getpgrp(void)
    return 0;

#ifndef __GNUC__
void vms_bcopy( const char *src, char *dst, int len )
    (void) memcpy(dst, src, len);
#endif /*!__GNUC__*/

#ifdef NO_VMS_ARGS      /* real code is in "vms/vms_args.c" */
void vms_arg_fixup( int *argc, char ***argv ) { return; }	/* dummy */

#ifdef NO_VMS_PIPES     /* real code is in "vms/vms_popen.c" */
FILE *popen( const char *command, const char *mode ) {
    fatal(" Cannot open pipe '%s' (not implemented)", command);
    return NULL;
int pclose( FILE *current ) {
    fatal(" Cannot close pipe #%d (not implemented)", fileno(current));
    return -1;
int fork( void ) {
    fatal(" Cannot fork process (not implemented)");
    return -1;
#endif /*NO_VMS_PIPES*/

 *	The following code is taken from the GNU C preprocessor (cccp.c,
 *	2.8.1 vintage) where it was used #if VMS.  It is only needed for
 *	VAX C and GNU C on VAX configurations; DEC C's run-time library
 *	doesn't have the problem described.
 *	VMS_fstat() and VMS_stat() were static in cccp.c but need to be
 *	accessible to the whole program here.  Also, the special handling
 *	for the null device has been introduced for gawk's benefit, to
 *	prevent --lint mode from giving spurious warnings about /dev/null 

The registered trademark Linux® is used pursuant to a sublicense from the Linux Foundation, the exclusive licensee of Linus Torvalds, owner of the mark on a world­wide basis.