!15 [sync] PR-14: fix CVE-2024-37535

From: @openeuler-sync-bot 
Reviewed-by: @happyworker, @technology208 
Signed-off-by: @technology208, @happyworker

0001-fix-CVE-2024-37535.patch

@@ -0,0 +1,125 @@
+From b6a976254b95f728ba17b369b387c19b26890141 Mon Sep 17 00:00:00 2001
+From: Christian Persch <Christian Persch@chpe>
+Date: Tue, 11 Jun 2024 02:59:02 +0000
+Subject: [PATCH] fix CVE-2024-37535
+
+---
+ src/vtegtk.cc | 35 +++++++++++++++++++++++++++++++++++
+ src/vteseq.cc | 20 ++++++++++++--------
+ 2 files changed, 47 insertions(+), 8 deletions(-)
+
+diff --git a/src/vtegtk.cc b/src/vtegtk.cc
+index 0457b2b..2f7c77b 100644
+--- a/src/vtegtk.cc
++++ b/src/vtegtk.cc
+@@ -91,6 +91,38 @@
+ template<typename T>
+ constexpr bool check_enum_value(T value) noexcept;
+ 
++static inline void
++sanitise_widget_size_request(int* minimum,
++                             int* natural) noexcept
++{
++        // Overly large size requests will make gtk happily allocate
++        // a window size over the window system's limits (see
++        // e.g. https://gitlab.gnome.org/GNOME/vte/-/issues/2786),
++        // leading to aborting the whole process.
++        // The toolkit should be in a better position to know about
++        // these limits and not exceed them (which here is certainly
++        // possible since our minimum sizes are very small), let's
++        // limit the widget's size request to some large value
++        // that hopefully is within the absolute limits of
++        // the window system (assumed here to be int16 range,
++        // and leaving some space for the widgets that contain
++        // the terminal).
++        auto const limit = (1 << 15) - (1 << 12);
++
++        if (*minimum > limit || *natural > limit) {
++                static auto warned = false;
++
++                if (!warned) {
++                        g_warning("Widget size request (minimum %d, natural %d) exceeds limits\n",
++                                  *minimum, *natural);
++                        warned = true;
++                }
++        }
++
++        *minimum = std::min(*minimum, limit);
++        *natural = std::clamp(*natural, *minimum, limit);
++}
++
+ struct _VteTerminalClassPrivate {
+         GtkStyleProvider *style_provider;
+ };
+@@ -485,6 +517,7 @@ try
+ {
+ 	VteTerminal *terminal = VTE_TERMINAL(widget);
+         WIDGET(terminal)->get_preferred_width(minimum_width, natural_width);
++	sanitise_widget_size_request(minimum_width, natural_width);
+ }
+ catch (...)
+ {
+@@ -499,6 +532,7 @@ try
+ {
+ 	VteTerminal *terminal = VTE_TERMINAL(widget);
+         WIDGET(terminal)->get_preferred_height(minimum_height, natural_height);
++	sanitise_widget_size_request(minimum_height, natural_height);
+ }
+ catch (...)
+ {
+@@ -736,6 +770,7 @@ try
+         WIDGET(terminal)->measure(orientation, for_size,
+                                   minimum, natural,
+                                   minimum_baseline, natural_baseline);
++	sanitise_widget_size_request(minimum, natural);
+ }
+ catch (...)
+ {
+diff --git a/src/vteseq.cc b/src/vteseq.cc
+index 8a7f5b3..7c0e227 100644
+--- a/src/vteseq.cc
++++ b/src/vteseq.cc
+@@ -214,9 +214,18 @@ Terminal::emit_bell()
+ /* Emit a "resize-window" signal.  (Grid size.) */
+ void
+ Terminal::emit_resize_window(guint columns,
+-                                       guint rows)
+-{
+-        _vte_debug_print(VTE_DEBUG_SIGNALS, "Emitting `resize-window'.\n");
++                             guint rows)
++{
++        // Ignore resizes with excessive number of rows or columns,
++        // see https://gitlab.gnome.org/GNOME/vte/-/issues/2786
++        if (columns < VTE_MIN_GRID_WIDTH ||
++            columns > 511 ||
++            rows < VTE_MIN_GRID_HEIGHT ||
++            rows > 511)
++                return;
++
++        _vte_debug_print(VTE_DEBUG_SIGNALS, "Emitting `resize-window' %d columns %d rows.\n",
++                         columns, rows);
+         g_signal_emit(m_terminal, signals[SIGNAL_RESIZE_WINDOW], 0, columns, rows);
+ }
+ 
+@@ -4581,8 +4590,6 @@ Terminal::DECSLPP(vte::parser::Sequence const& seq)
+         else if (param < 24)
+                 return;
+ 
+-        _vte_debug_print(VTE_DEBUG_EMULATION, "Resizing to %d rows.\n", param);
+-
+         emit_resize_window(m_column_count, param);
+ }
+ 
+@@ -9044,9 +9051,6 @@ Terminal::XTERM_WM(vte::parser::Sequence const& seq)
+                 seq.collect(1, {&height, &width});
+ 
+                 if (width != -1 && height != -1) {
+-                        _vte_debug_print(VTE_DEBUG_EMULATION,
+-                                         "Resizing window to %d columns, %d rows.\n",
+-                                         width, height);
+                         emit_resize_window(width, height);
+                 }
+                 break;
+-- 
+2.43.0
+

vte291-vala-Make-binding-tests-compile-without-warning.patch

@@ -1,257 +0,0 @@
-From b1b365cf8162479adc10db2ffcf40e4844bf739d Mon Sep 17 00:00:00 2001
-Date: Thu, 11 Jun 2020 11:40:16 +0800
-
----
- bindings/vala/app.vala | 96 +++++++++++++++++++++---------------------
- 1 file changed, 48 insertions(+), 48 deletions(-)
-
-diff --git a/bindings/vala/app.vala b/bindings/vala/app.vala
-index 3b73106..b6c3b65 100644
---- a/bindings/vala/app.vala
-+++ b/bindings/vala/app.vala
-@@ -109,7 +109,7 @@ class SearchPopover : Gtk.Popover
- 
-     if (search_text.length != 0) {
-       try {
--        if (!App.Options.no_pcre) {
-+        if (!Options.no_pcre) {
-           uint32 flags;
- 
-           flags = 0x40080400u /* PCRE2_UTF | PCRE2_NO_UTF_CHECK | PCRE2_MULTILINE */;
-@@ -148,7 +148,7 @@ class SearchPopover : Gtk.Popover
-       search_entry.set_tooltip_text(null);
-     }
- 
--    if (!App.Options.no_pcre) {
-+    if (!Options.no_pcre) {
-       has_regex = regex != null;
-       terminal.search_set_regex(regex, 0);
-     } else {
-@@ -210,7 +210,7 @@ class Window : Gtk.ApplicationWindow
- 
-     /* Create terminal and connect scrollbar */
-     terminal = new Vte.Terminal();
--    var margin = App.Options.extra_margin;
-+    var margin = Options.extra_margin;
-     if (margin > 0) {
-       terminal.margin_start =
-         terminal.margin_end =
-@@ -274,8 +274,8 @@ class Window : Gtk.ApplicationWindow
-     title = "Terminal";
- 
-     /* Set ARGB visual */
--    if (App.Options.transparency_percent != 0) {
--      if (!App.Options.no_argb_visual) {
-+    if (Options.transparency_percent != 0) {
-+      if (!Options.no_argb_visual) {
-         var screen = get_screen();
-         Gdk.Visual? visual = screen.get_rgba_visual();
-         if (visual != null)
-@@ -306,57 +306,57 @@ class Window : Gtk.ApplicationWindow
-     terminal.restore_window.connect(restore_window_cb);
-     terminal.selection_changed.connect(selection_changed_cb);
-     terminal.window_title_changed.connect(window_title_changed_cb);
--    if (App.Options.object_notifications)
-+    if (Options.object_notifications)
-       terminal.notify.connect(notify_cb);
- 
-     terminal.notification_received.connect(notification_received_cb);
- 
-     /* Settings */
--    if (App.Options.no_double_buffer)
-+    if (Options.no_double_buffer)
-       terminal.set_double_buffered(false);
- 
--    if (App.Options.encoding != null) {
-+    if (Options.encoding != null) {
-       try {
--        terminal.set_encoding(App.Options.encoding);
-+        terminal.set_encoding(Options.encoding);
-       } catch (Error e) {
-         printerr("Failed to set encoding: %s\n", e.message);
-       }
-     }
- 
--    if (App.Options.word_char_exceptions != null)
--      terminal.set_word_char_exceptions(App.Options.word_char_exceptions);
-+    if (Options.word_char_exceptions != null)
-+      terminal.set_word_char_exceptions(Options.word_char_exceptions);
- 
--    terminal.set_allow_hyperlink(!App.Options.no_hyperlink);
--    terminal.set_audible_bell(App.Options.audible);
--    terminal.set_cjk_ambiguous_width(App.Options.get_cjk_ambiguous_width());
--    terminal.set_cursor_blink_mode(App.Options.get_cursor_blink_mode());
--    terminal.set_cursor_shape(App.Options.get_cursor_shape());
-+    terminal.set_allow_hyperlink(!Options.no_hyperlink);
-+    terminal.set_audible_bell(Options.audible);
-+    terminal.set_cjk_ambiguous_width(Options.get_cjk_ambiguous_width());
-+    terminal.set_cursor_blink_mode(Options.get_cursor_blink_mode());
-+    terminal.set_cursor_shape(Options.get_cursor_shape());
-     terminal.set_mouse_autohide(true);
--    terminal.set_rewrap_on_resize(!App.Options.no_rewrap);
-+    terminal.set_rewrap_on_resize(!Options.no_rewrap);
-     terminal.set_scroll_on_output(false);
-     terminal.set_scroll_on_keystroke(true);
--    terminal.set_scroll_speed(App.Options.scroll_speed);
--    terminal.set_scrollback_lines(App.Options.scrollback_lines);
-+    terminal.set_scroll_speed(Options.scroll_speed);
-+    terminal.set_scrollback_lines(Options.scrollback_lines);
- 
-     /* Style */
--    if (App.Options.font_string != null) {
--      var desc = Pango.FontDescription.from_string(App.Options.font_string);
-+    if (Options.font_string != null) {
-+      var desc = Pango.FontDescription.from_string(Options.font_string);
-       terminal.set_font(desc);
-     }
- 
--    terminal.set_colors(App.Options.get_color_fg(),
--                        App.Options.get_color_bg(),
-+    terminal.set_colors(Options.get_color_fg(),
-+                        Options.get_color_bg(),
-                         null);
--    terminal.set_color_cursor(App.Options.get_color_cursor_background());
--    terminal.set_color_cursor_foreground(App.Options.get_color_cursor_foreground());
--    terminal.set_color_highlight(App.Options.get_color_hl_bg());
--    terminal.set_color_highlight_foreground(App.Options.get_color_hl_fg());
-+    terminal.set_color_cursor(Options.get_color_cursor_background());
-+    terminal.set_color_cursor_foreground(Options.get_color_cursor_foreground());
-+    terminal.set_color_highlight(Options.get_color_hl_bg());
-+    terminal.set_color_highlight_foreground(Options.get_color_hl_fg());
- 
-     /* Dingus */
--    if (!App.Options.no_builtin_dingus)
-+    if (!Options.no_builtin_dingus)
-       add_dingus(builtin_dingus);
--    if (App.Options.dingus != null)
--      add_dingus(App.Options.dingus);
-+    if (Options.dingus != null)
-+      add_dingus(Options.dingus);
- 
-     /* Done! */
-     terminal_box.pack_start(terminal);
-@@ -378,7 +378,7 @@ class Window : Gtk.ApplicationWindow
-       try {
-         int tag;
- 
--        if (!App.Options.no_pcre) {
-+        if (!Options.no_pcre) {
-           Vte.Regex regex;
- 
-           regex = new Vte.Regex.for_match(dingus[i], dingus[i].length,
-@@ -427,8 +427,8 @@ class Window : Gtk.ApplicationWindow
-      */
-     terminal.realize();
- 
--    if (App.Options.geometry != null) {
--      if (parse_geometry(App.Options.geometry)) {
-+    if (Options.geometry != null) {
-+      if (parse_geometry(Options.geometry)) {
-         /* After parse_geometry(), we can get the default size in
-          * width/height increments, i.e. in grid size.
-          */
-@@ -437,7 +437,7 @@ class Window : Gtk.ApplicationWindow
-         terminal.set_size(columns, rows);
-         resize_to_geometry(columns, rows);
-       } else
--        printerr("Failed to parse geometry spec \"%s\"\n", App.Options.geometry);
-+        printerr("Failed to parse geometry spec \"%s\"\n", Options.geometry);
-     } else {
-       /* In GTK+ 3.0, the default size of a window comes from its minimum
-        * size not its natural size, so we need to set the right default size
-@@ -455,9 +455,9 @@ class Window : Gtk.ApplicationWindow
-     launch_idle_id = GLib.Idle.add(() => {
-         try {
-           terminal.spawn_sync(Vte.PtyFlags.DEFAULT,
--                              App.Options.working_directory,
-+                              Options.working_directory,
-                               argv,
--                              App.Options.environment,
-+                              Options.environment,
-                               GLib.SpawnFlags.SEARCH_PATH,
-                               null, /* child setup */
-                               out child_pid,
-@@ -524,9 +524,9 @@ class Window : Gtk.ApplicationWindow
-   public void launch()
-   {
-     try {
--      if (App.Options.command != null)
--        launch_command(App.Options.command);
--      else if (!App.Options.no_shell)
-+      if (Options.command != null)
-+        launch_command(Options.command);
-+      else if (!Options.no_shell)
-         launch_shell();
-       else
-         fork();
-@@ -557,7 +557,7 @@ class Window : Gtk.ApplicationWindow
- 
-   private void update_geometry()
-   {
--    if (App.Options.no_geometry_hints)
-+    if (Options.no_geometry_hints)
-       return;
-     if (!terminal.get_realized())
-       return;
-@@ -627,7 +627,7 @@ class Window : Gtk.ApplicationWindow
- 
-   private bool show_context_menu(uint button, uint32 timestamp, Gdk.Event? event)
-   {
--    if (App.Options.no_context_menu)
-+    if (Options.no_context_menu)
-       return false;
- 
-     var menu = new GLib.Menu();
-@@ -665,18 +665,18 @@ class Window : Gtk.ApplicationWindow
-   {
-     printerr("Child exited with status %x\n", status);
- 
--    if (App.Options.output_filename != null) {
-+    if (Options.output_filename != null) {
-       try {
--        var file = GLib.File.new_for_commandline_arg(App.Options.output_filename);
-+        var file = GLib.File.new_for_commandline_arg(Options.output_filename);
-         var stream = file.replace(null, false, GLib.FileCreateFlags.NONE, null);
-         terminal.write_contents_sync(stream, Vte.WriteFlags.DEFAULT, null);
-       } catch (Error e) {
-         printerr("Failed to write output to \"%s\": %s\n",
--                 App.Options.output_filename, e.message);
-+                 Options.output_filename, e.message);
-       }
-     }
- 
--    if (App.Options.keep)
-+    if (Options.keep)
-       return;
- 
-     destroy();
-@@ -808,7 +808,7 @@ class App : Gtk.Application
-   {
-     base.startup();
- 
--    for (uint i = 0; i < App.Options.n_windows.clamp(0, 16); i++)
-+    for (uint i = 0; i < Options.n_windows.clamp(0, 16); i++)
-       new Window(this);
-   }
- 
-@@ -824,8 +824,9 @@ class App : Gtk.Application
-       window.launch();
-     }
-   }
-+} /* class App */
- 
--  public struct Options
-+  namespace Options
-   {
-     public static bool audible = false;
-     public static string? command = null;
-@@ -1105,6 +1106,5 @@ class App : Gtk.Application
-     var app = new App();
-     return app.run(null);
-   }
--} /* class App */
- 
- } /* namespace */
--- 
-2.23.0
-

vte291.spec

@@ -1,25 +1,54 @@
-Name:           vte291
-Version:        0.62.1
-Release:        1
-Summary:        Virtual terminal widget
-License:        LGPLv2+ and GPLv3+
-URL:            http://www.gnome.org/
-Source0:        http://download.gnome.org/sources/vte/0.62/vte-%{version}.tar.xz
-Patch0000:      vte291-cntnr-precmd-preexec-scroll.patch
+%global apiver 2.91
+
+%global fribidi_version 1.0.0
+%global glib2_version 2.52.0
+%global gnutls_version 3.2.7
+%global gtk3_version 3.24.22
+%global gtk4_version 4.0.1
+%global icu_uc_version 4.8
+%global libsystemd_version 220
+%global pango_version 1.22.0
+%global pcre2_version 10.21
+
+Name:           vte291
+Version:        0.72.2
+Release:        2
+Summary:        Virtual terminal widget
+License:        GPL-3.0-or-later AND LGPL-3.0-or-later and MIT-open-group AND CC-BY-4.0
+URL:            https://wiki.gnome.org/Apps/Terminal/VTE
+Source0:        https://download.gnome.org/sources/vte/0.72/vte-%{version}.tar.xz
+Patch0:         vte291-cntnr-precmd-preexec-scroll.patch
+Patch1:         0001-fix-CVE-2024-37535.patch
+
+BuildRequires:  gcc-c++ gettext gi-docgen gobject-introspection-devel gperf meson systemd vala
+BuildRequires:  pkgconfig(fribidi) >= %{fribidi_version}
+BuildRequires:  pkgconfig(gio-2.0) >= %{glib2_version}
+BuildRequires:  pkgconfig(glib-2.0) >= %{glib2_version}
+BuildRequires:  pkgconfig(gnutls) >= %{gnutls_version}
+BuildRequires:  pkgconfig(gobject-2.0) >= %{glib2_version}
+BuildRequires:  pkgconfig(gtk+-3.0) >= %{gtk3_version}
+BuildRequires:  pkgconfig(gtk4) >= %{gtk4_version}
+BuildRequires:  pkgconfig(icu-uc) >= %{icu_uc_version}
+BuildRequires:  pkgconfig(libpcre2-8) >= %{pcre2_version}
+BuildRequires:  pkgconfig(libsystemd) >= %{libsystemd_version}
+BuildRequires:  pkgconfig(pango) >= %{pango_version}
+BuildRequires:  pkgconfig(zlib)
+
+Requires:       fribidi >= %{fribidi_version}
+Requires:       glib2 >= %{glib2_version}
+Requires:       gnutls%{?_isa} >= %{gnutls_version}
+Requires:       gtk3%{?_isa} >= %{gtk3_version}
+Requires:       libicu%{?_isa} >= %{icu_uc_version}
+Requires:       pango >= %{pango_version}
+Requires:       pcre2%{?_isa} >= %{pcre2_version}
+Requires:       systemd-libs >= %{libsystemd_version}
+Requires:       vte-profile
 
-BuildRequires:  gcc-c++ gettext pkgconfig(gnutls) >= 3.2.7
-BuildRequires:  gobject-introspection-devel gperf pkgconfig(gtk+-3.0) >= 3.24.22
-BuildRequires:  pkgconfig(libpcre2-8) >= 10.21 vala systemd gtk-doc meson
-BuildRequires:  pkgconfig(fribidi) >= 1.0.0 pkgconfig(gio-2.0) >= 2.52.0
-BuildRequires:  pkgconfig(glib-2.0) >= 2.52.0 pkgconfig(gobject-2.0) >= 2.52.0
-BuildRequires:  pkgconfig(icu-uc) >= 4.8 pkgconfig(libsystemd) >= 220
-BuildRequires:  pkgconfig(pango) >= 1.22.0
-Requires:       gnutls >= 3.2.7 gtk3 >= 3.24.22 pcre2 >= 10.21
-Requires:       fribidi >= 1.0.0 glib2 >= 2.52.0 pango >= 1.22.0
-Requires:       libicu >= 4.8 systemd
 Conflicts:      gnome-terminal < 3.20.1-2 vte3 < 0.36.1-3
 Provides:       vte-profile = %{version}-%{release}
 Obsoletes:      vte-profile < %{version}-%{release}
+Provides:       vte291-gtk4%{?_isa} = %{version}-%{release}
+Provides:       vte291-gtk4 = %{version}-%{release}
 
 %description
 VTE provides a virtual terminal widget for GTK applications.VTE
@@ -28,11 +57,16 @@ console/terminal in games, editors, IDEs, etc.
 
 %package        devel
 Summary:        Development files for %{name}
+License:        GPLv3+ and LGPLv3+
 Requires:       %{name} = %{version}-%{release}
+Provides:       vte291-gtk4-devel%{?_isa} = %{version}-%{release}
+Provides:       vte291-gtk4-devel = %{version}-%{release}
 
 %description    devel
 The package contains libraries and header files for developing applications that use vte291.
 
+%package_help
+
 %prep
 %autosetup -n vte-%{version} -p1
 %if 0%{?flatpak}
@@ -41,36 +75,65 @@ sed -i -e "/^vte_systemduserunitdir =/s|vte_prefix|'/usr'|" meson.build
 %endif
 
 %build
-%meson --buildtype=plain -Ddocs=true
+%meson --buildtype=plain -Ddocs=true -Dgtk3=true -Dgtk4=true
 %meson_build
 
 %install
 %meson_install
-%find_lang vte-2.91
 
-%files -f vte-2.91.lang
-%license COPYING.GPL3
-%{_libdir}/libvte-*.so.0*
+%find_lang vte-%{apiver}
+
+%files -f vte-%{apiver}.lang
+%license COPYING.LGPL3
+%license COPYING.XTERM
+%{_libdir}/libvte-%{apiver}.so.0*
+%{_libdir}/libvte-%{apiver}-gtk4.so.0*
 %{_libdir}/girepository-1.0/
-%{_userunitdir}/vte-spawn-.scope.d
 %{_libexecdir}/vte-urlencode-cwd
-%{_sysconfdir}/profile.d/vte.sh
 %{_sysconfdir}/profile.d/vte.csh
+%{_sysconfdir}/profile.d/vte.sh
+%{_userunitdir}/vte-spawn-.scope.d
 
 %files devel
-%{_bindir}/vte-*
-%{_includedir}/vte-2.91/
-%{_libdir}/libvte-*.so
-%{_libdir}/pkgconfig/vte-*.pc
+%license COPYING.GPL3
+%{_bindir}/vte-%{apiver}
+%{_bindir}/vte-%{apiver}-gtk4
+%{_includedir}/vte-%{apiver}/
+%{_includedir}/vte-%{apiver}-gtk4/
+%{_libdir}/libvte-%{apiver}.so
+%{_libdir}/libvte-%{apiver}-gtk4.so
+%{_libdir}/pkgconfig/vte-%{apiver}.pc
+%{_libdir}/pkgconfig/vte-%{apiver}-gtk4.pc
 %{_datadir}/gir-1.0/
-%doc %{_datadir}/gtk-doc/
+%{_datadir}/glade/
 %{_datadir}/vala/
 
+%files help
+%doc README.md
+%doc %{_datadir}/doc/vte-2.91/
+%doc %{_datadir}/doc/vte-2.91-gtk4/
+
 %changelog
+* Tue Jun 11 2024 kywqs <weiqingsong@kylinos.cn> - 0.72.2-2
+- fix CVE-2024-37535
+
+* Mon Nov 20 2023 lwg <liweiganga@uniontech.com> - 0.72.2-1
+- update to version 0.72.2
+
+* Mon Jan 02 2023 lin zhang <lin.zhang@turbolinux.com.cn> - 0.70.2-1
+- Upgrade to 0.70.2
+
+* Wed Apr 20 2022 dillon chen <dillon.chen@gmail.com> - 0.68.0-1
+- Update to 0.68.0
+
+* Mon May 24 2021 weijin deng <weijin.deng@turbolinux.com.cn> - 0.62.3-1
+- Upgrade to 0.62.3
+- Update Version, uncorrect date
+
 * Tue Dec 22 2020 huanghaitao <huanghaitao8@huawei.com> - 0.62.1-1
 - Updata to 0.62.1 
 
-* Wed Jun 19 2019 wangyue <wangyue92@huawei.com> - 0.54.1-5
+* Fri Jun 19 2020 wangyue <wangyue92@huawei.com> - 0.54.1-5
 - DESC:Make binding tests compile without warning
 
 * Mon Oct 21 2019 Lijin Yang <yanglijin@huawei.com> - 0.54.1-4