mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-08 17:19:20 +00:00
Code Issues Projects Releases Wiki Activity

screen: fix CVE-2015-6806

Browse Source 
Backport a patch to fix CVE-2015-6806

(From OE-Core rev: 0f2dbfd939ed2d9f2cbbed4d1522e77c4d1672b2)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Maxin B. John
2015-10-07 05:53:38 +03:00
committed by Richard Purdie
parent acdc2db899
commit 8d5878b35f
2 changed files with 58 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-extended/screen/screen/0001-Fix-stack-overflow-due-to-too-deep-recursion.patch
+57
View File
@@ -0,0 +1,57 @@
Bug: 45713
How to reproduce:
Run this command inside screen
$ printf '\x1b[10000000T'
screen will recursively call MScrollV to depth n/256.
This is time consuming and will overflow stack if n is huge.
Fixes CVE-2015-6806
Upstream-Status: Backport
Signed-off-by: Kuang-che Wu <kcwu@csie.org>
Signed-off-by: Amadeusz Sławiński <amade@asmblr.net>
Signed-off-by: Maxin B. John <maxin.john@intel.com>
---
diff -Naur screen-4.3.1-orig/ansi.c screen-4.3.1/ansi.c
--- screen-4.3.1-orig/ansi.c 2015-06-29 00:22:55.000000000 +0300
+++ screen-4.3.1/ansi.c 2015-10-06 13:13:58.297648039 +0300
@@ -2502,13 +2502,13 @@
return;
if (n > 0)
{
+ if (ye - ys + 1 < n)
+ n = ye - ys + 1;
if (n > 256)
{
MScrollV(p, n - 256, ys, ye, bce);
n = 256;
}
- if (ye - ys + 1 < n)
- n = ye - ys + 1;
#ifdef COPY_PASTE
if (compacthist)
{
@@ -2562,15 +2562,15 @@
}
else
{
- if (n < -256)
- {
- MScrollV(p, n + 256, ys, ye, bce);
- n = -256;
- }
n = -n;
if (ye - ys + 1 < n)
n = ye - ys + 1;
+ if (n > 256)
+ {
+ MScrollV(p, - (n - 256), ys, ye, bce);
+ n = 256;
+ }
ml = p->w_mlines + ye;
/* Clear lines */
for (i = ye; i > ye - n; i--, ml--)
meta/recipes-extended/screen/screen_4.3.1.bb
+1
View File
@@ -24,6 +24,7 @@ SRC_URI = "${GNU_MIRROR}/screen/screen-${PV}.tar.gz \
file://Avoid-mis-identifying-systems-as-SVR4.patch \
file://0001-fix-for-multijob-build.patch \
file://0002-comm.h-now-depends-on-term.h.patch \
file://0001-Fix-stack-overflow-due-to-too-deep-recursion.patch \
"
SRC_URI[md5sum] = "5bb3b0ff2674e29378c31ad3411170ad"