diff options
Diffstat (limited to 'meta/recipes-extended/screen/screen/0001-Fix-stack-overflow-due-to-too-deep-recursion.patch')
-rw-r--r-- | meta/recipes-extended/screen/screen/0001-Fix-stack-overflow-due-to-too-deep-recursion.patch | 58 |
1 files changed, 0 insertions, 58 deletions
diff --git a/meta/recipes-extended/screen/screen/0001-Fix-stack-overflow-due-to-too-deep-recursion.patch b/meta/recipes-extended/screen/screen/0001-Fix-stack-overflow-due-to-too-deep-recursion.patch deleted file mode 100644 index 4ac820fde2..0000000000 --- a/meta/recipes-extended/screen/screen/0001-Fix-stack-overflow-due-to-too-deep-recursion.patch +++ /dev/null | |||
@@ -1,58 +0,0 @@ | |||
1 | Bug: 45713 | ||
2 | |||
3 | How to reproduce: | ||
4 | Run this command inside screen | ||
5 | $ printf '\x1b[10000000T' | ||
6 | |||
7 | screen will recursively call MScrollV to depth n/256. | ||
8 | This is time consuming and will overflow stack if n is huge. | ||
9 | |||
10 | Fixes CVE-2015-6806 | ||
11 | |||
12 | Upstream-Status: Backport | ||
13 | CVE: CVE-2015-6806 | ||
14 | |||
15 | Signed-off-by: Kuang-che Wu <kcwu@csie.org> | ||
16 | Signed-off-by: Amadeusz Sławiński <amade@asmblr.net> | ||
17 | Signed-off-by: Maxin B. John <maxin.john@intel.com> | ||
18 | --- | ||
19 | diff -Naur screen-4.3.1-orig/ansi.c screen-4.3.1/ansi.c | ||
20 | --- screen-4.3.1-orig/ansi.c 2015-06-29 00:22:55.000000000 +0300 | ||
21 | +++ screen-4.3.1/ansi.c 2015-10-06 13:13:58.297648039 +0300 | ||
22 | @@ -2502,13 +2502,13 @@ | ||
23 | return; | ||
24 | if (n > 0) | ||
25 | { | ||
26 | + if (ye - ys + 1 < n) | ||
27 | + n = ye - ys + 1; | ||
28 | if (n > 256) | ||
29 | { | ||
30 | MScrollV(p, n - 256, ys, ye, bce); | ||
31 | n = 256; | ||
32 | } | ||
33 | - if (ye - ys + 1 < n) | ||
34 | - n = ye - ys + 1; | ||
35 | #ifdef COPY_PASTE | ||
36 | if (compacthist) | ||
37 | { | ||
38 | @@ -2562,15 +2562,15 @@ | ||
39 | } | ||
40 | else | ||
41 | { | ||
42 | - if (n < -256) | ||
43 | - { | ||
44 | - MScrollV(p, n + 256, ys, ye, bce); | ||
45 | - n = -256; | ||
46 | - } | ||
47 | n = -n; | ||
48 | if (ye - ys + 1 < n) | ||
49 | n = ye - ys + 1; | ||
50 | |||
51 | + if (n > 256) | ||
52 | + { | ||
53 | + MScrollV(p, - (n - 256), ys, ye, bce); | ||
54 | + n = 256; | ||
55 | + } | ||
56 | ml = p->w_mlines + ye; | ||
57 | /* Clear lines */ | ||
58 | for (i = ye; i > ye - n; i--, ml--) | ||