mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-22 15:32:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

ncurses: patch CVE-2023-50495

Browse Source 
backport relevant parts from
https://invisible-island.net/archives/ncurses/6.4/ncurses-6.4-20230424.patch.gz

(From OE-Core rev: 6a54788ebe147ecd8e347ff8d2ba95a1c461d27d)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko
2024-04-13 00:14:26 +02:00
committed by Steve Sakoman
parent 9d9c54071e
commit 71267466e9
2 changed files with 82 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
meta/recipes-core/ncurses/files/CVE-2023-50495.patch Normal file
View File

@@ -0,0 +1,81 @@
commit ebc08cff36689eec54edc1ce2de6ebac826bd6cd
Author: Peter Marko <peter.marko@siemens.com>
Date: Fri Apr 12 23:56:25 2024 +0200
check return value of _nc_save_str(), in special case for tic where
extended capabilities are processed but the terminal description was
not initialized (report by Ziqiao Kong).
Only parts relevant for this CVE was extracted from upstream patch.
CVE: CVE-2023-45853
Upstream-Status: Backport [https://invisible-island.net/archives/ncurses/6.4/ncurses-6.4-20230424.patch.gz]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
ncurses/tinfo/parse_entry.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/ncurses/tinfo/parse_entry.c b/ncurses/tinfo/parse_entry.c
index a77cd0b..8ac02ac 100644
--- a/ncurses/tinfo/parse_entry.c
+++ b/ncurses/tinfo/parse_entry.c
@@ -110,7 +110,7 @@ _nc_extend_names(ENTRY * entryp, const char *name, int token_type)
/* Well, we are given a cancel for a name that we don't recognize */
return _nc_extend_names(entryp, name, STRING);
default:
- return 0;
+ return NULL;
}
/* Adjust the 'offset' (insertion-point) to keep the lists of extended
@@ -142,6 +142,11 @@ _nc_extend_names(ENTRY * entryp, const char *name, int token_type)
for (last = (unsigned) (max - 1); last > tindex; last--)
if (!found) {
+ char *saved;
+
+ if ((saved = _nc_save_str(name)) == NULL)
+ return NULL;
+
switch (token_type) {
case BOOLEAN:
tp->ext_Booleans++;
@@ -169,7 +174,7 @@ _nc_extend_names(ENTRY * entryp, const char *name, int token_type)
TYPE_REALLOC(char *, actual, tp->ext_Names);
while (--actual > offset)
tp->ext_Names[actual] = tp->ext_Names[actual - 1];
- tp->ext_Names[offset] = _nc_save_str(name);
+ tp->ext_Names[offset] = saved;
}
temp.nte_name = tp->ext_Names[offset];
@@ -337,6 +342,8 @@ _nc_parse_entry(ENTRY * entryp, int literal, bool silent)
bool is_use = (strcmp(_nc_curr_token.tk_name, "use") == 0);
bool is_tc = !is_use && (strcmp(_nc_curr_token.tk_name, "tc") == 0);
if (is_use || is_tc) {
+ char *saved;
+
if (!VALID_STRING(_nc_curr_token.tk_valstring)
|| _nc_curr_token.tk_valstring[0] == '\0') {
_nc_warning("missing name for use-clause");
@@ -350,11 +357,13 @@ _nc_parse_entry(ENTRY * entryp, int literal, bool silent)
_nc_curr_token.tk_valstring);
continue;
}
- entryp->uses[entryp->nuses].name = _nc_save_str(_nc_curr_token.tk_valstring);
- entryp->uses[entryp->nuses].line = _nc_curr_line;
- entryp->nuses++;
- if (entryp->nuses > 1 && is_tc) {
- BAD_TC_USAGE
+ if ((saved = _nc_save_str(_nc_curr_token.tk_valstring)) != NULL) {
+ entryp->uses[entryp->nuses].name = saved;
+ entryp->uses[entryp->nuses].line = _nc_curr_line;
+ entryp->nuses++;
+ if (entryp->nuses > 1 && is_tc) {
+ BAD_TC_USAGE
+ }
}
} else {
/* normal token lookup */

1
meta/recipes-core/ncurses/ncurses_6.3+20220423.bb
View File

@@ -4,6 +4,7 @@ SRC_URI += "file://0001-tic-hang.patch \
file://0002-configure-reproducible.patch \
file://0003-gen-pkgconfig.in-Do-not-include-LDFLAGS-in-generated.patch \
file://CVE-2023-29491.patch \
file://CVE-2023-50495.patch \
"
# commit id corresponds to the revision in package version
SRCREV = "a0bc708bc6954b5d3c0a38d92b683c3ec3135260"