diff options
| -rw-r--r-- | meta/recipes-extended/screen/screen/CVE-2021-26937.patch | 68 | ||||
| -rw-r--r-- | meta/recipes-extended/screen/screen_4.9.0.bb (renamed from meta/recipes-extended/screen/screen_4.8.0.bb) | 4 |
2 files changed, 1 insertions, 71 deletions
diff --git a/meta/recipes-extended/screen/screen/CVE-2021-26937.patch b/meta/recipes-extended/screen/screen/CVE-2021-26937.patch deleted file mode 100644 index 983b35c1b0..0000000000 --- a/meta/recipes-extended/screen/screen/CVE-2021-26937.patch +++ /dev/null | |||
| @@ -1,68 +0,0 @@ | |||
| 1 | Description: [CVE-2021-26937] Fix out of bounds array access | ||
| 2 | Author: Michael Schröder <mls@suse.de> | ||
| 3 | Bug-Debian: https://bugs.debian.org/982435 | ||
| 4 | Bug: https://savannah.gnu.org/bugs/?60030 | ||
| 5 | Bug: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html | ||
| 6 | Bug-OSS-Security: https://www.openwall.com/lists/oss-security/2021/02/09/3 | ||
| 7 | Origin: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00010.html | ||
| 8 | |||
| 9 | CVE: CVE-2021-26937 | ||
| 10 | Upstream-Status: Pending | ||
| 11 | Signed-off-by: Scott Murray <scott.murray@konsulko.com> | ||
| 12 | |||
| 13 | --- a/encoding.c | ||
| 14 | +++ b/encoding.c | ||
| 15 | @@ -43,7 +43,7 @@ | ||
| 16 | # ifdef UTF8 | ||
| 17 | static int recode_char __P((int, int, int)); | ||
| 18 | static int recode_char_to_encoding __P((int, int)); | ||
| 19 | -static void comb_tofront __P((int, int)); | ||
| 20 | +static void comb_tofront __P((int)); | ||
| 21 | # ifdef DW_CHARS | ||
| 22 | static int recode_char_dw __P((int, int *, int, int)); | ||
| 23 | static int recode_char_dw_to_encoding __P((int, int *, int)); | ||
| 24 | @@ -1263,6 +1263,8 @@ | ||
| 25 | {0x30000, 0x3FFFD}, | ||
| 26 | }; | ||
| 27 | |||
| 28 | + if (c >= 0xdf00 && c <= 0xdfff) | ||
| 29 | + return 1; /* dw combining sequence */ | ||
| 30 | return ((bisearch(c, wide, sizeof(wide) / sizeof(struct interval) - 1)) || | ||
| 31 | (cjkwidth && | ||
| 32 | bisearch(c, ambiguous, | ||
| 33 | @@ -1330,11 +1332,12 @@ | ||
| 34 | } | ||
| 35 | |||
| 36 | static void | ||
| 37 | -comb_tofront(root, i) | ||
| 38 | -int root, i; | ||
| 39 | +comb_tofront(i) | ||
| 40 | +int i; | ||
| 41 | { | ||
| 42 | for (;;) | ||
| 43 | { | ||
| 44 | + int root = i >= 0x700 ? 0x801 : 0x800; | ||
| 45 | debug1("bring to front: %x\n", i); | ||
| 46 | combchars[combchars[i]->prev]->next = combchars[i]->next; | ||
| 47 | combchars[combchars[i]->next]->prev = combchars[i]->prev; | ||
| 48 | @@ -1396,9 +1399,9 @@ | ||
| 49 | { | ||
| 50 | /* full, recycle old entry */ | ||
| 51 | if (c1 >= 0xd800 && c1 < 0xe000) | ||
| 52 | - comb_tofront(root, c1 - 0xd800); | ||
| 53 | + comb_tofront(c1 - 0xd800); | ||
| 54 | i = combchars[root]->prev; | ||
| 55 | - if (c1 == i + 0xd800) | ||
| 56 | + if (i == 0x800 || i == 0x801 || c1 == i + 0xd800) | ||
| 57 | { | ||
| 58 | /* completely full, can't recycle */ | ||
| 59 | debug("utf8_handle_comp: completely full!\n"); | ||
| 60 | @@ -1422,7 +1425,7 @@ | ||
| 61 | mc->font = (i >> 8) + 0xd8; | ||
| 62 | mc->fontx = 0; | ||
| 63 | debug3("combinig char %x %x -> %x\n", c1, c, i + 0xd800); | ||
| 64 | - comb_tofront(root, i); | ||
| 65 | + comb_tofront(i); | ||
| 66 | } | ||
| 67 | |||
| 68 | #else /* !UTF8 */ | ||
diff --git a/meta/recipes-extended/screen/screen_4.8.0.bb b/meta/recipes-extended/screen/screen_4.9.0.bb index 6d307d5abc..1ed0961630 100644 --- a/meta/recipes-extended/screen/screen_4.8.0.bb +++ b/meta/recipes-extended/screen/screen_4.9.0.bb | |||
| @@ -21,11 +21,9 @@ SRC_URI = "${GNU_MIRROR}/screen/screen-${PV}.tar.gz \ | |||
| 21 | file://0002-comm.h-now-depends-on-term.h.patch \ | 21 | file://0002-comm.h-now-depends-on-term.h.patch \ |
| 22 | file://0001-fix-for-multijob-build.patch \ | 22 | file://0001-fix-for-multijob-build.patch \ |
| 23 | file://0001-Remove-more-compatibility-stuff.patch \ | 23 | file://0001-Remove-more-compatibility-stuff.patch \ |
| 24 | file://CVE-2021-26937.patch \ | ||
| 25 | " | 24 | " |
| 26 | 25 | ||
| 27 | SRC_URI[md5sum] = "d276213d3acd10339cd37848b8c4ab1e" | 26 | SRC_URI[sha256sum] = "f9335281bb4d1538ed078df78a20c2f39d3af9a4e91c57d084271e0289c730f4" |
| 28 | SRC_URI[sha256sum] = "6e11b13d8489925fde25dfb0935bf6ed71f9eb47eff233a181e078fde5655aa1" | ||
| 29 | 27 | ||
| 30 | inherit autotools texinfo | 28 | inherit autotools texinfo |
| 31 | 29 | ||
