mirror of
https://git.yoctoproject.org/poky
synced 2026-01-29 21:08:42 +01:00
ncurses: Fix CVE-2023-45918
ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c. References: https://nvd.nist.gov/vuln/detail/CVE-2023-45918 (From OE-Core rev: 6573995adf4cfd48b036f8463b39f3864fcfd85b) (From OE-Core rev: 5385b15345dddc958fc961246e56b962db735276) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Soumya Sambu
committed by
Steve Sakoman
Steve Sakoman
parent
50b2758182
commit
c78f26dbfd
180
meta/recipes-core/ncurses/files/CVE-2023-45918.patch
Normal file
180
meta/recipes-core/ncurses/files/CVE-2023-45918.patch
Normal file
@@ -0,0 +1,180 @@
|
||||
From bcf02d3242f1c7d57224a95f7903fcf4b5e7695d Mon Sep 17 00:00:00 2001
|
||||
From: Thomas E. Dickey <dickey@invisible-island.net>
|
||||
Date: Fri, 16 Jun 2023 02:54:29 +0530
|
||||
Subject: [PATCH] Fix CVE-2023-45918
|
||||
|
||||
CVE: CVE-2023-45918
|
||||
|
||||
Upstream-Status: Backport [https://ncurses.scripts.mit.edu/?p=ncurses.git;a=commit;h=bcf02d3242f1c7d57224a95f7903fcf4b5e7695d]
|
||||
|
||||
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
|
||||
---
|
||||
ncurses/tinfo/comp_error.c | 15 ++++++---
|
||||
ncurses/tinfo/read_entry.c | 65 ++++++++++++++++++++++++++------------
|
||||
2 files changed, 56 insertions(+), 24 deletions(-)
|
||||
|
||||
diff --git a/ncurses/tinfo/comp_error.c b/ncurses/tinfo/comp_error.c
|
||||
index 48f48784..ee518e28 100644
|
||||
--- a/ncurses/tinfo/comp_error.c
|
||||
+++ b/ncurses/tinfo/comp_error.c
|
||||
@@ -60,8 +60,15 @@ _nc_get_source(void)
|
||||
NCURSES_EXPORT(void)
|
||||
_nc_set_source(const char *const name)
|
||||
{
|
||||
- FreeIfNeeded(SourceName);
|
||||
- SourceName = strdup(name);
|
||||
+ if (name == NULL) {
|
||||
+ free(SourceName);
|
||||
+ SourceName = NULL;
|
||||
+ } else if (SourceName == NULL) {
|
||||
+ SourceName = strdup(name);
|
||||
+ } else if (strcmp(name, SourceName)) {
|
||||
+ free(SourceName);
|
||||
+ SourceName = strdup(name);
|
||||
+ }
|
||||
}
|
||||
|
||||
NCURSES_EXPORT(void)
|
||||
@@ -95,9 +102,9 @@ static NCURSES_INLINE void
|
||||
where_is_problem(void)
|
||||
{
|
||||
fprintf(stderr, "\"%s\"", SourceName ? SourceName : "?");
|
||||
- if (_nc_curr_line >= 0)
|
||||
+ if (_nc_curr_line > 0)
|
||||
fprintf(stderr, ", line %d", _nc_curr_line);
|
||||
- if (_nc_curr_col >= 0)
|
||||
+ if (_nc_curr_col > 0)
|
||||
fprintf(stderr, ", col %d", _nc_curr_col);
|
||||
if (TermType != 0 && TermType[0] != '\0')
|
||||
fprintf(stderr, ", terminal '%s'", TermType);
|
||||
diff --git a/ncurses/tinfo/read_entry.c b/ncurses/tinfo/read_entry.c
|
||||
index 341337d2..b0c3ad26 100644
|
||||
--- a/ncurses/tinfo/read_entry.c
|
||||
+++ b/ncurses/tinfo/read_entry.c
|
||||
@@ -138,12 +138,13 @@ convert_16bits(char *buf, NCURSES_INT2 *Numbers, int count)
|
||||
}
|
||||
#endif
|
||||
|
||||
-static void
|
||||
-convert_strings(char *buf, char **Strings, int count, int size, char *table)
|
||||
+static bool
|
||||
+convert_strings(char *buf, char **Strings, int count, int size,
|
||||
+ char *table, bool always)
|
||||
{
|
||||
int i;
|
||||
char *p;
|
||||
- bool corrupt = FALSE;
|
||||
+ bool success = TRUE;
|
||||
|
||||
for (i = 0; i < count; i++) {
|
||||
if (IS_NEG1(buf + 2 * i)) {
|
||||
@@ -159,13 +160,10 @@ convert_strings(char *buf, char **Strings, int count, int size, char *table)
|
||||
TR(TRACE_DATABASE, ("Strings[%d] = %s", i,
|
||||
_nc_visbuf(Strings[i])));
|
||||
} else {
|
||||
- if (!corrupt) {
|
||||
- corrupt = TRUE;
|
||||
- TR(TRACE_DATABASE,
|
||||
- ("ignore out-of-range index %d to Strings[]", nn));
|
||||
- _nc_warning("corrupt data found in convert_strings");
|
||||
- }
|
||||
- Strings[i] = ABSENT_STRING;
|
||||
+ TR(TRACE_DATABASE,
|
||||
+ ("found out-of-range index %d to Strings[%d]", nn, i));
|
||||
+ success = FALSE;
|
||||
+ break;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -175,10 +173,25 @@ convert_strings(char *buf, char **Strings, int count, int size, char *table)
|
||||
if (*p == '\0')
|
||||
break;
|
||||
/* if there is no NUL, ignore the string */
|
||||
- if (p >= table + size)
|
||||
+ if (p >= table + size) {
|
||||
Strings[i] = ABSENT_STRING;
|
||||
+ } else if (p == Strings[i] && always) {
|
||||
+ TR(TRACE_DATABASE,
|
||||
+ ("found empty but required Strings[%d]", i));
|
||||
+ success = FALSE;
|
||||
+ break;
|
||||
+ }
|
||||
+ } else if (always) { /* names are always needed */
|
||||
+ TR(TRACE_DATABASE,
|
||||
+ ("found invalid but required Strings[%d]", i));
|
||||
+ success = FALSE;
|
||||
+ break;
|
||||
}
|
||||
}
|
||||
+ if (!success) {
|
||||
+ _nc_warning("corrupt data found in convert_strings");
|
||||
+ }
|
||||
+ return success;
|
||||
}
|
||||
|
||||
static int
|
||||
@@ -382,7 +395,10 @@ _nc_read_termtype(TERMTYPE2 *ptr, char *buffer, int limit)
|
||||
if (Read(string_table, (unsigned) str_size) != str_size) {
|
||||
returnDB(TGETENT_NO);
|
||||
}
|
||||
- convert_strings(buf, ptr->Strings, str_count, str_size, string_table);
|
||||
+ if (!convert_strings(buf, ptr->Strings, str_count, str_size,
|
||||
+ string_table, FALSE)) {
|
||||
+ returnDB(TGETENT_NO);
|
||||
+ }
|
||||
}
|
||||
#if NCURSES_XNAMES
|
||||
|
||||
@@ -483,8 +499,10 @@ _nc_read_termtype(TERMTYPE2 *ptr, char *buffer, int limit)
|
||||
("Before computing extended-string capabilities "
|
||||
"str_count=%d, ext_str_count=%d",
|
||||
str_count, ext_str_count));
|
||||
- convert_strings(buf, ptr->Strings + str_count, ext_str_count,
|
||||
- ext_str_limit, ptr->ext_str_table);
|
||||
+ if (!convert_strings(buf, ptr->Strings + str_count, ext_str_count,
|
||||
+ ext_str_limit, ptr->ext_str_table, FALSE)) {
|
||||
+ returnDB(TGETENT_NO);
|
||||
+ }
|
||||
for (i = ext_str_count - 1; i >= 0; i--) {
|
||||
TR(TRACE_DATABASE, ("MOVE from [%d:%d] %s",
|
||||
i, i + str_count,
|
||||
@@ -516,10 +534,13 @@ _nc_read_termtype(TERMTYPE2 *ptr, char *buffer, int limit)
|
||||
TR(TRACE_DATABASE,
|
||||
("ext_NAMES starting @%d in extended_strings, first = %s",
|
||||
base, _nc_visbuf(ptr->ext_str_table + base)));
|
||||
- convert_strings(buf + (2 * ext_str_count),
|
||||
- ptr->ext_Names,
|
||||
- (int) need,
|
||||
- ext_str_limit, ptr->ext_str_table + base);
|
||||
+ if (!convert_strings(buf + (2 * ext_str_count),
|
||||
+ ptr->ext_Names,
|
||||
+ (int) need,
|
||||
+ ext_str_limit, ptr->ext_str_table + base,
|
||||
+ TRUE)) {
|
||||
+ returnDB(TGETENT_NO);
|
||||
+ }
|
||||
}
|
||||
|
||||
TR(TRACE_DATABASE,
|
||||
@@ -572,13 +593,17 @@ _nc_read_file_entry(const char *const filename, TERMTYPE2 *ptr)
|
||||
int limit;
|
||||
char buffer[MAX_ENTRY_SIZE + 1];
|
||||
|
||||
- if ((limit = (int) fread(buffer, sizeof(char), sizeof(buffer), fp))
|
||||
- > 0) {
|
||||
+ limit = (int) fread(buffer, sizeof(char), sizeof(buffer), fp);
|
||||
+ if (limit > 0) {
|
||||
+ const char *old_source = _nc_get_source();
|
||||
|
||||
TR(TRACE_DATABASE, ("read terminfo %s", filename));
|
||||
+ if (old_source == NULL)
|
||||
+ _nc_set_source(filename);
|
||||
if ((code = _nc_read_termtype(ptr, buffer, limit)) == TGETENT_NO) {
|
||||
_nc_free_termtype2(ptr);
|
||||
}
|
||||
+ _nc_set_source(old_source);
|
||||
} else {
|
||||
code = TGETENT_NO;
|
||||
}
|
||||
--
|
||||
2.40.0
|
||||
@@ -7,6 +7,7 @@ SRC_URI += "file://0001-tic-hang.patch \
|
||||
file://0001-Fix-CVE-2023-29491.patch \
|
||||
file://0001-Updating-reset-code-ncurses-6.4-patch-20231104.patch \
|
||||
file://CVE-2023-50495.patch \
|
||||
file://CVE-2023-45918.patch \
|
||||
"
|
||||
# commit id corresponds to the revision in package version
|
||||
SRCREV = "79b9071f2be20a24c7be031655a5638f6032f29f"
|
||||
|
||||
Reference in New Issue
Block a user