gnu/packages/patches/vte-CVE-2012-2738-pt2.patch

   1 From 98ce2f265f986fb88c38d508286bb5e3716b9e74 Mon Sep 17 00:00:00 2001
   2 From: Christian Persch <chpe@gnome.org>
   3 Date: Sat, 19 May 2012 18:04:12 +0000
   4 Subject: emulation: Limit repetitions
   5
   6 Don't allow malicious sequences to cause excessive repetitions.
   7
   8 https://bugzilla.gnome.org/show_bug.cgi?id=676090
   9 ---
  10 diff --git a/src/vteseq.c b/src/vteseq.c
  11 index 46def5b..7fb4707 100644
  12 --- a/src/vteseq.c
  13 +++ b/src/vteseq.c
  14 @@ -1397,7 +1397,7 @@ vte_sequence_handler_dc (VteTerminal *terminal, GValueArray *params)
  15  static void
  16  vte_sequence_handler_DC (VteTerminal *terminal, GValueArray *params)
  17  {
  18 -       vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_dc);
  19 +       vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_dc);
  20  }
  21
  22  /* Delete a line at the current cursor position. */
  23 @@ -1790,7 +1790,7 @@ vte_sequence_handler_reverse_index (VteTerminal *terminal, GValueArray *params)
  24  static void
  25  vte_sequence_handler_RI (VteTerminal *terminal, GValueArray *params)
  26  {
  27 -       vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_nd);
  28 +       vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_nd);
  29  }
  30
  31  /* Save cursor (position). */
  32 @@ -2782,8 +2782,7 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
  33  {
  34         GValue *value;
  35         VteScreen *screen;
  36 -       long param, end, row;
  37 -       int i;
  38 +       long param, end, row, i, limit;
  39         screen = terminal->pvt->screen;
  40         /* The default is one. */
  41         param = 1;
  42 @@ -2801,7 +2800,13 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
  43         } else {
  44                 end = screen->insert_delta + terminal->row_count - 1;
  45         }
  46 -       /* Insert the new lines at the cursor. */
  47 +
  48 +       /* Only allow to insert as many lines as there are between this row
  49 +         * and the end of the scrolling region. See bug #676090.
  50 +         */
  51 +        limit = end - row + 1;
  52 +        param = MIN (param, limit);
  53 +
  54         for (i = 0; i < param; i++) {
  55                 /* Clear a line off the end of the region and add one to the
  56                  * top of the region. */
  57 @@ -2822,8 +2827,7 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
  58  {
  59         GValue *value;
  60         VteScreen *screen;
  61 -       long param, end, row;
  62 -       int i;
  63 +       long param, end, row, i, limit;
  64
  65         screen = terminal->pvt->screen;
  66         /* The default is one. */
  67 @@ -2842,6 +2846,13 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
  68         } else {
  69                 end = screen->insert_delta + terminal->row_count - 1;
  70         }
  71 +
  72 +        /* Only allow to delete as many lines as there are between this row
  73 +         * and the end of the scrolling region. See bug #676090.
  74 +         */
  75 +        limit = end - row + 1;
  76 +        param = MIN (param, limit);
  77 +
  78         /* Clear them from below the current cursor. */
  79         for (i = 0; i < param; i++) {
  80                 /* Insert a line at the end of the region and remove one from
  81 --
  82 cgit v0.9.0.2