Restore package and package alist in handlers.

When setting up a handler frame, we note down the current
package alist and package in the frame. Then when invoking the
handler, we rebind the *package* and *package-alist* special
variables.

This is a needed security measure for sandboxing.  Since
handlers do not unwind (and therefore do not restore special
variables) a handler in sandboxed code could catch an
exception from non-sandboxed code that has changed *package*
or *package-alist*, and take advantage of those changed
values to escape from the sandbox.

* unwind.c (uw_push_handler): Store current package and
package-alist into new fields in the handler frame.
(invoke_handler): Set up a new dynamic environment and
bind *package* and *package-alist* around the handler
call, to the values noted in the frame. Thus the handler
executes with whatever package context was current when
the handler was established.

* unwind.h (struct uw_handler): New members, package and
package_alist.

* txr.1: Add paragraph to Exception Handling about this
issue.

1 files changed, 1 insertions, 0 deletions

diff --git a/unwind.h b/unwind.h
index 7f8cec02..c887a423 100644
--- a/unwind.h
+++ b/unwind.h
@@ -70,6 +70,7 @@ struct uw_handler {
   val matches; /* Same position as in uw_catch! */
   int visible; /* Likewise. */
   val fun;
+  val package, package_alist;
 };
 
 struct uw_cont_copy {