diff options
author | Cy Schubert <cy@FreeBSD.org> | 2021-02-16 00:45:09 +0000 |
---|---|---|
committer | Cy Schubert <cy@FreeBSD.org> | 2021-02-16 00:45:09 +0000 |
commit | 80237935b359debf898463412b93b913db6338e5 (patch) | |
tree | 57646d5bce536a76189bac9873bd750d4040e5ad /sysutils/screen | |
parent | acf42a5e1959d41d7bf9de80b44d0a11fed7e78a (diff) | |
download | ports-80237935b359debf898463412b93b913db6338e5.tar.gz ports-80237935b359debf898463412b93b913db6338e5.zip |
Fix CVE-2021-26937 for real: segfaults by displaying some UTF-8 characters
This is a recommit of r565281 fixing a typo in r565281, causing
a regression.
CVE-2021-26937 segfaults when displayingsome UTF-8 characters
described in
https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html.
PR: 253515
Reported by: daniel.engberg.lists at pyret.net
Obtained from: https://build.opensuse.org/request/show/871482
MFH: 2020Q1
Security: CVE-2021-26937
Notes
Notes:
svn path=/head/; revision=565376
Diffstat (limited to 'sysutils/screen')
-rw-r--r-- | sysutils/screen/Makefile | 2 | ||||
-rw-r--r-- | sysutils/screen/files/patch-ansi.c | 24 | ||||
-rw-r--r-- | sysutils/screen/files/patch-encoding.c | 56 |
3 files changed, 81 insertions, 1 deletions
diff --git a/sysutils/screen/Makefile b/sysutils/screen/Makefile index 4c4f93966e97..f93f5bde2e00 100644 --- a/sysutils/screen/Makefile +++ b/sysutils/screen/Makefile @@ -3,7 +3,7 @@ PORTNAME= screen PORTVERSION= 4.8.0 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= sysutils MASTER_SITES= GNU \ ftp://ftp.gnu.org/gnu/screen/ \ diff --git a/sysutils/screen/files/patch-ansi.c b/sysutils/screen/files/patch-ansi.c new file mode 100644 index 000000000000..74ed96c079cd --- /dev/null +++ b/sysutils/screen/files/patch-ansi.c @@ -0,0 +1,24 @@ +--- ansi.c.orig 2020-02-05 12:09:38.000000000 -0800 ++++ ansi.c 2021-02-14 11:10:31.759160000 -0800 +@@ -692,10 +692,6 @@ + } + curr->w_rend.font = 0; + } +-# ifdef DW_CHARS +- if (curr->w_encoding == UTF8 && utf8_isdouble(c)) +- curr->w_mbcs = 0xff; +-# endif + if (curr->w_encoding == UTF8 && c >= 0x0300 && utf8_iscomb(c)) + { + int ox, oy; +@@ -730,6 +726,10 @@ + } + break; + } ++# ifdef DW_CHARS ++ if (curr->w_encoding == UTF8 && utf8_isdouble(c)) ++ curr->w_mbcs = 0xff; ++# endif + font = curr->w_rend.font; + # endif + # ifdef DW_CHARS diff --git a/sysutils/screen/files/patch-encoding.c b/sysutils/screen/files/patch-encoding.c new file mode 100644 index 000000000000..0702f6b0a05c --- /dev/null +++ b/sysutils/screen/files/patch-encoding.c @@ -0,0 +1,56 @@ +--- encoding.c.orig 2020-02-05 12:09:38.000000000 -0800 ++++ encoding.c 2021-02-14 11:15:26.074193000 -0800 +@@ -43,7 +43,7 @@ + # ifdef UTF8 + static int recode_char __P((int, int, int)); + static int recode_char_to_encoding __P((int, int)); +-static void comb_tofront __P((int, int)); ++static void comb_tofront __P((int)); + # ifdef DW_CHARS + static int recode_char_dw __P((int, int *, int, int)); + static int recode_char_dw_to_encoding __P((int, int *, int)); +@@ -1263,6 +1263,8 @@ + {0x30000, 0x3FFFD}, + }; + ++ if (c >= 0xdf00 && c <= 0xdfff) ++ return 1; /* dw comining sequence */ + return ((bisearch(c, wide, sizeof(wide) / sizeof(struct interval) - 1)) || + (cjkwidth && + bisearch(c, ambiguous, +@@ -1330,11 +1332,12 @@ + } + + static void +-comb_tofront(root, i) +-int root, i; ++comb_tofront( i) ++int i; + { + for (;;) + { ++ int root = i >= 0x700 ? 0x801 : 0x800; + debug1("bring to front: %x\n", i); + combchars[combchars[i]->prev]->next = combchars[i]->next; + combchars[combchars[i]->next]->prev = combchars[i]->prev; +@@ -1396,9 +1399,9 @@ + { + /* full, recycle old entry */ + if (c1 >= 0xd800 && c1 < 0xe000) +- comb_tofront(root, c1 - 0xd800); ++ comb_tofront(c1 - 0xd800); + i = combchars[root]->prev; +- if (c1 == i + 0xd800) ++ if (i == 0x800 || i == 0x801 || c1 == i + 0xd800) + { + /* completely full, can't recycle */ + debug("utf8_handle_comp: completely full!\n"); +@@ -1422,7 +1425,7 @@ + mc->font = (i >> 8) + 0xd8; + mc->fontx = 0; + debug3("combinig char %x %x -> %x\n", c1, c, i + 0xd800); +- comb_tofront(root, i); ++ comb_tofront(i); + } + + #else /* !UTF8 */ |