From 6f6db0e8fd14e40096a0ee6f8bdf32dedbd3fc9e Mon Sep 17 00:00:00 2001
From: Hitendra Prajapati <hprajapati@mvista.com>
Date: Mon, 6 Apr 2026 18:08:09 +0530
Subject: [PATCH] add limit-check in infocmp

origin : https://invisible-island.net/archives/ncurses/6.5/ncurses-6.5-20251213.patch.gz
Refer: https://github.com/Cao-Wuhui/CVE-2025-69720
patch by : Thomas E. Dickey <dickey@invisible-island.net>

CVE: CVE-2025-69720
Upstream-Status: Backport [https://github.com/ThomasDickey/ncurses-snapshots/commit/6f6db0e8fd14e40096a0ee6f8bdf32dedbd3fc9e]
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
 progs/infocmp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/progs/infocmp.c b/progs/infocmp.c
index 0ee0b958..538aca5a 100644
--- a/progs/infocmp.c
+++ b/progs/infocmp.c
@@ -816,7 +816,7 @@ lookup_params(const assoc * table, char *dst, char *src)
 static void
 analyze_string(const char *name, const char *cap, TERMTYPE2 *tp)
 {
-    char buf2[MAX_TERMINFO_LENGTH];
+    char buf2[MAX_TERMINFO_LENGTH + 1];
     const char *sp;
     const assoc *ap;
     int tp_lines = tp->Numbers[2];
@@ -846,7 +846,8 @@ analyze_string(const char *name, const char *cap, TERMTYPE2 *tp)
 	    if (VALID_STRING(cp) &&
 		cp[0] != '\0' &&
 		cp != cap) {
-		len = strlen(cp);
+		if ((len = strlen(cp)) > MAX_TERMINFO_LENGTH)
+		    len = MAX_TERMINFO_LENGTH;
 		_nc_STRNCPY(buf2, sp, len);
 		buf2[len] = '\0';
 
-- 
2.50.1

