mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-08 05:09:24 +00:00
Code Issues Projects Releases Wiki Activity

ncurses: fix for CVE-2025-69720

Browse Source 
Pick relevant part of snapshot commit 20251213, see [1].

That has:
add a limit-check in infocmp -i option (report/example by Yixuan Cao).

[1] https://invisible-island.net/ncurses/NEWS.html#index-t20251213

References:
1. https://github.com/Cao-Wuhui/CVE-2025-69720
2. https://nvd.nist.gov/vuln/detail/CVE-2025-69720
3. https://access.redhat.com/errata/RHSA-2026:5913

(From OE-Core rev: 4a046b39185314ceafbc7846b9c00fb8984c71ce)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Hitendra Prajapati
2026-04-07 11:14:03 +05:30
committed by Paul Barker
parent e728c23ab3
commit f5a60f9888
2 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-core/ncurses/files/CVE-2025-69720.patch
+42
View File
@@ -0,0 +1,42 @@
From 6f6db0e8fd14e40096a0ee6f8bdf32dedbd3fc9e Mon Sep 17 00:00:00 2001
From: Hitendra Prajapati <hprajapati@mvista.com>
Date: Mon, 6 Apr 2026 18:08:09 +0530
Subject: [PATCH] add limit-check in infocmp
origin : https://invisible-island.net/archives/ncurses/6.5/ncurses-6.5-20251213.patch.gz
Refer: https://github.com/Cao-Wuhui/CVE-2025-69720
patch by : Thomas E. Dickey <dickey@invisible-island.net>
CVE: CVE-2025-69720
Upstream-Status: Backport [https://github.com/ThomasDickey/ncurses-snapshots/commit/6f6db0e8fd14e40096a0ee6f8bdf32dedbd3fc9e]
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
progs/infocmp.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/progs/infocmp.c b/progs/infocmp.c
index 0ee0b958..538aca5a 100644
--- a/progs/infocmp.c
+++ b/progs/infocmp.c
@@ -816,7 +816,7 @@ lookup_params(const assoc * table, char *dst, char *src)
static void
analyze_string(const char *name, const char *cap, TERMTYPE2 *tp)
{
- char buf2[MAX_TERMINFO_LENGTH];
+ char buf2[MAX_TERMINFO_LENGTH + 1];
const char *sp;
const assoc *ap;
int tp_lines = tp->Numbers[2];
@@ -846,7 +846,8 @@ analyze_string(const char *name, const char *cap, TERMTYPE2 *tp)
if (VALID_STRING(cp) &&
cp[0] != '\0' &&
cp != cap) {
- len = strlen(cp);
+ if ((len = strlen(cp)) > MAX_TERMINFO_LENGTH)
+ len = MAX_TERMINFO_LENGTH;
_nc_STRNCPY(buf2, sp, len);
buf2[len] = '\0';
--
2.50.1
meta/recipes-core/ncurses/ncurses_6.3+20220423.bb
+1
View File
@@ -7,6 +7,7 @@ SRC_URI += "file://0001-tic-hang.patch \
file://CVE-2023-50495.patch \
file://CVE-2023-45918.patch \
file://CVE-2025-6141.patch \
file://CVE-2025-69720.patch \
"
# commit id corresponds to the revision in package version
SRCREV = "a0bc708bc6954b5d3c0a38d92b683c3ec3135260"