cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Apply patches from upstream bugzilla (#676090, malicious escape sequences can cause denial of service).

Browse Source
This commit is contained in:
jasper 2012-05-29 20:31:40 +00:00
parent 5da10430d2
commit fcf75f8e78
3 changed files with 116 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
devel/vte/Makefile
View File

@ -1,4 +1,4 @@
# $OpenBSD: Makefile,v 1.98 2012/03/09 06:45:54 ajacoutot Exp $
# $OpenBSD: Makefile,v 1.99 2012/05/29 20:31:40 jasper Exp $
# Don't pull in x11/py-gtk2 on these archs; build fails with binutils 2.15
NOT_FOR_ARCHS-python= mips64 mips64el
@ -14,7 +14,7 @@ SHARED_LIBS+= vte 14.1 # 2609.0
FULLPKGNAME-main= vte-${GNOME_VERSION}
FULLPKGNAME-python= py-${DISTNAME}
REVISION-main = 7
REVISION-main = 8
REVISION-python = 4
CATEGORIES= devel

20
devel/vte/patches/patch-src_table_c Normal file
View File

@ -0,0 +1,20 @@
$OpenBSD: patch-src_table_c,v 1.1 2012/05/29 20:31:40 jasper Exp $
From feeee4b5832b17641e505b7083e0d299fdae318e Mon Sep 17 00:00:00 2001
From: Christian Persch <chpe@gnome.org>
Date: Sat, 19 May 2012 19:36:09 +0200
Subject: [PATCH] emulation: Limit integer arguments to 65535
https://bugzilla.gnome.org/show_bug.cgi?id=676090
--- src/table.c.orig Tue Aug 16 23:52:48 2011
+++ src/table.c Tue May 29 22:22:59 2012
@@ -550,7 +550,7 @@ _vte_table_extract_numbers(GValueArray **array,
if (G_UNLIKELY (*array == NULL)) {
*array = g_value_array_new(1);
}
- g_value_set_long(&value, total);
+ g_value_set_long(&value, CLAMP (total, 0, G_MAXUSHORT));
g_value_array_append(*array, &value);
} while (i++ < arginfo->length);
g_value_unset(&value);

94
devel/vte/patches/patch-src_vteseq_c Normal file
View File

@ -0,0 +1,94 @@
$OpenBSD: patch-src_vteseq_c,v 1.2 2012/05/29 20:31:40 jasper Exp $
Chunk 1:
From feeee4b5832b17641e505b7083e0d299fdae318e Mon Sep 17 00:00:00 2001
From: Christian Persch <chpe@gnome.org>
Date: Sat, 19 May 2012 19:36:09 +0200
Subject: [PATCH] emulation: Limit integer arguments to 65535
Chunk 2:
From 98ce2f265f986fb88c38d508286bb5e3716b9e74 Mon Sep 17 00:00:00 2001
From: Christian Persch <chpe@gnome.org>
Date: Sat, 19 May 2012 20:04:12 +0200
Subject: [PATCH] emulation: Limit repetitions
Both address: https://bugzilla.gnome.org/show_bug.cgi?id=676090
--- src/vteseq.c.orig Tue May 29 22:24:06 2012
+++ src/vteseq.c Tue May 29 22:23:59 2012
@@ -557,7 +557,7 @@ vte_sequence_handler_multiple(VteTerminal *terminal,
GValueArray *params,
VteTerminalSequenceHandler handler)
{
- vte_sequence_handler_multiple_limited(terminal, params, handler, G_MAXLONG);
+ vte_sequence_handler_multiple_limited(terminal, params, handler, G_MAXUSHORT);
}
static void
@@ -1392,7 +1392,7 @@ vte_sequence_handler_dc (VteTerminal *terminal, GValue
static void
vte_sequence_handler_DC (VteTerminal *terminal, GValueArray *params)
{
- vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_dc);
+ vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_dc);
}
/* Delete a line at the current cursor position. */
@@ -1785,7 +1785,7 @@ vte_sequence_handler_reverse_index (VteTerminal *termi
static void
vte_sequence_handler_RI (VteTerminal *terminal, GValueArray *params)
{
- vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_nd);
+ vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_nd);
}
/* Save cursor (position). */
@@ -2777,8 +2777,7 @@ vte_sequence_handler_insert_lines (VteTerminal *termin
{
GValue *value;
VteScreen *screen;
- long param, end, row;
- int i;
+ long param, end, row, i, limit;
screen = terminal->pvt->screen;
/* The default is one. */
param = 1;
@@ -2796,7 +2795,13 @@ vte_sequence_handler_insert_lines (VteTerminal *termin
} else {
end = screen->insert_delta + terminal->row_count - 1;
}
- /* Insert the new lines at the cursor. */
+
+ /* Only allow to insert as many lines as there are between this row
+ * and the end of the scrolling region. See bug #676090.
+ */
+ limit = end - row + 1;
+ param = MIN (param, limit);
+
for (i = 0; i < param; i++) {
/* Clear a line off the end of the region and add one to the
* top of the region. */
@@ -2817,8 +2822,7 @@ vte_sequence_handler_delete_lines (VteTerminal *termin
{
GValue *value;
VteScreen *screen;
- long param, end, row;
- int i;
+ long param, end, row, i, limit;
screen = terminal->pvt->screen;
/* The default is one. */
@@ -2837,6 +2841,13 @@ vte_sequence_handler_delete_lines (VteTerminal *termin
} else {
end = screen->insert_delta + terminal->row_count - 1;
}
+
+ /* Only allow to delete as many lines as there are between this row
+ * and the end of the scrolling region. See bug #676090.
+ */
+ limit = end - row + 1;
+ param = MIN (param, limit);
+
/* Clear them from below the current cursor. */
for (i = 0; i < param; i++) {
/* Insert a line at the end of the region and remove one from