mirror of
git://git.yoctoproject.org/poky
synced 2026-09-16 08:02:28 +00:00
9bb12fb4c5
Pick relevant part of snapshot commit 20251213, see [1]. That has: add a limit-check in infocmp -i option (report/example by Yixuan Cao). [1] https://invisible-island.net/ncurses/NEWS.html#index-t20251213 References: 1. https://github.com/Cao-Wuhui/CVE-2025-69720 2. https://nvd.nist.gov/vuln/detail/CVE-2025-69720 3. https://access.redhat.com/errata/RHSA-2026:5913 (From OE-Core rev: a4364099e0593757bc848dc766843d7651550224) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
43 lines
1.4 KiB
Diff
43 lines
1.4 KiB
Diff
From 6f6db0e8fd14e40096a0ee6f8bdf32dedbd3fc9e Mon Sep 17 00:00:00 2001
|
|
From: Hitendra Prajapati <hprajapati@mvista.com>
|
|
Date: Mon, 6 Apr 2026 18:08:09 +0530
|
|
Subject: [PATCH] add limit-check in infocmp
|
|
|
|
origin : https://invisible-island.net/archives/ncurses/6.5/ncurses-6.5-20251213.patch.gz
|
|
Refer: https://github.com/Cao-Wuhui/CVE-2025-69720
|
|
patch by : Thomas E. Dickey <dickey@invisible-island.net>
|
|
|
|
CVE: CVE-2025-69720
|
|
Upstream-Status: Backport [https://github.com/ThomasDickey/ncurses-snapshots/commit/6f6db0e8fd14e40096a0ee6f8bdf32dedbd3fc9e]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
progs/infocmp.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/progs/infocmp.c b/progs/infocmp.c
|
|
index 171d794d..2fc1f035 100644
|
|
--- a/progs/infocmp.c
|
|
+++ b/progs/infocmp.c
|
|
@@ -816,7 +816,7 @@ lookup_params(const assoc * table, char *dst, char *src)
|
|
static void
|
|
analyze_string(const char *name, const char *cap, TERMTYPE2 *tp)
|
|
{
|
|
- char buf2[MAX_TERMINFO_LENGTH];
|
|
+ char buf2[MAX_TERMINFO_LENGTH + 1];
|
|
const char *sp;
|
|
const assoc *ap;
|
|
int tp_lines = tp->Numbers[2];
|
|
@@ -846,7 +846,8 @@ analyze_string(const char *name, const char *cap, TERMTYPE2 *tp)
|
|
if (VALID_STRING(cp) &&
|
|
cp[0] != '\0' &&
|
|
cp != cap) {
|
|
- len = strlen(cp);
|
|
+ if ((len = strlen(cp)) > MAX_TERMINFO_LENGTH)
|
|
+ len = MAX_TERMINFO_LENGTH;
|
|
_nc_STRNCPY(buf2, sp, len);
|
|
buf2[len] = '\0';
|
|
|
|
--
|
|
2.50.1
|
|
|