ncurses/backport-CVE-2021-39537-add-check-for-end-of-string-in-cvtchar-to-handle-a-malformed.patch
2021-10-12 10:20:50 +08:00

47 lines
1.6 KiB
Diff

From 790a85dbd4a81d5f5d8dd02a44d84f01512ef443 Mon Sep 17 00:00:00 2001
From: "Thomas E. Dickey" <dickey@invisible-island.net>
Date: Mon, 1 Jun 2020 00:02:30 +0000
Subject: [PATCH] ncurses 6.2 - patch 20200531
+ correct configure version-check/warnng for g++ to allow for 10.x
+ re-enable "bel" in konsole-base (report by Nia Huang)
+ add linux-s entry (patch by Alexandre Montaron).
+ drop long-obsolete convert_configure.pl
+ add test/test_parm.c, for checking tparm changes.
+ improve parameter-checking for tparm, adding function _nc_tiparm() to
handle the most-used case, which accepts only numeric parameters
(report/testcase by "puppet-meteor").
+ use a more conservative estimate of the buffer-size in lib_tparm.c's
save_text() and save_number(), in case the sprintf() function
passes-through unexpected characters from a format specifier
(report/testcase by "puppet-meteor").
+ add a check for end-of-string in cvtchar to handle a malformed
string in infotocap (report/testcase by "puppet-meteor").
---
ncurses/tinfo/captoinfo.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/ncurses/tinfo/captoinfo.c b/ncurses/tinfo/captoinfo.c
index 8b3b83d..f0b8c31 100644
--- a/ncurses/tinfo/captoinfo.c
+++ b/ncurses/tinfo/captoinfo.c
@@ -216,12 +216,15 @@ cvtchar(register const char *sp)
}
break;
case '^':
+ len = 2;
c = UChar(*++sp);
- if (c == '?')
+ if (c == '?') {
c = 127;
- else
+ } else if (c == '\0') {
+ len = 1;
+ } else {
c &= 0x1f;
- len = 2;
+ }
break;
default:
c = UChar(*sp);