From 3cf5df0ebc792869b4cd0b7f0fbaddbe9e39a1ba Mon Sep 17 00:00:00 2001 From: starlet-dx <15929766099@163.com> Date: Thu, 14 Apr 2022 10:28:59 +0800 Subject: [PATCH] Fix CVE-2012-2738 (cherry picked from commit 88f5bdcff193daae04bee6939c49c86f7a14aa31) --- ...t-arguments.patch => CVE-2012-2738-1.patch | 0 CVE-2012-2738-2.patch | 82 +++++++++++++++++++ vte.spec | 14 +++- 3 files changed, 92 insertions(+), 4 deletions(-) rename vte-0.28.2-limit-arguments.patch => CVE-2012-2738-1.patch (100%) create mode 100644 CVE-2012-2738-2.patch diff --git a/vte-0.28.2-limit-arguments.patch b/CVE-2012-2738-1.patch similarity index 100% rename from vte-0.28.2-limit-arguments.patch rename to CVE-2012-2738-1.patch diff --git a/CVE-2012-2738-2.patch b/CVE-2012-2738-2.patch new file mode 100644 index 0000000..e98fd35 --- /dev/null +++ b/CVE-2012-2738-2.patch @@ -0,0 +1,82 @@ +From 98ce2f265f986fb88c38d508286bb5e3716b9e74 Mon Sep 17 00:00:00 2001 +From: Christian Persch +Date: Sat, 19 May 2012 18:04:12 +0000 +Subject: emulation: Limit repetitions + +Don't allow malicious sequences to cause excessive repetitions. + +https://bugzilla.gnome.org/show_bug.cgi?id=676090 +--- +diff --git a/src/vteseq.c b/src/vteseq.c +index 46def5b..7fb4707 100644 +--- a/src/vteseq.c ++++ b/src/vteseq.c +@@ -1397,7 +1397,7 @@ vte_sequence_handler_dc (VteTerminal *terminal, GValueArray *params) + static void + vte_sequence_handler_DC (VteTerminal *terminal, GValueArray *params) + { +- vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_dc); ++ vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_dc); + } + + /* Delete a line at the current cursor position. */ +@@ -1790,7 +1790,7 @@ vte_sequence_handler_reverse_index (VteTerminal *terminal, GValueArray *params) + static void + vte_sequence_handler_RI (VteTerminal *terminal, GValueArray *params) + { +- vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_nd); ++ vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_nd); + } + + /* Save cursor (position). */ +@@ -2782,8 +2782,7 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params) + { + GValue *value; + VteScreen *screen; +- long param, end, row; +- int i; ++ long param, end, row, i, limit; + screen = terminal->pvt->screen; + /* The default is one. */ + param = 1; +@@ -2801,7 +2800,13 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params) + } else { + end = screen->insert_delta + terminal->row_count - 1; + } +- /* Insert the new lines at the cursor. */ ++ ++ /* Only allow to insert as many lines as there are between this row ++ * and the end of the scrolling region. See bug #676090. ++ */ ++ limit = end - row + 1; ++ param = MIN (param, limit); ++ + for (i = 0; i < param; i++) { + /* Clear a line off the end of the region and add one to the + * top of the region. */ +@@ -2822,8 +2827,7 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params) + { + GValue *value; + VteScreen *screen; +- long param, end, row; +- int i; ++ long param, end, row, i, limit; + + screen = terminal->pvt->screen; + /* The default is one. */ +@@ -2842,6 +2846,13 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params) + } else { + end = screen->insert_delta + terminal->row_count - 1; + } ++ ++ /* Only allow to delete as many lines as there are between this row ++ * and the end of the scrolling region. See bug #676090. ++ */ ++ limit = end - row + 1; ++ param = MIN (param, limit); ++ + /* Clear them from below the current cursor. */ + for (i = 0; i < param; i++) { + /* Insert a line at the end of the region and remove one from +-- +cgit v0.9.0.2 diff --git a/vte.spec b/vte.spec index cd3ae94..ac9d63c 100644 --- a/vte.spec +++ b/vte.spec @@ -3,7 +3,7 @@ %define gtk2_version 2.20.0 Name: vte Version: 0.28.2 -Release: 3 +Release: 4 Summary: A terminal emulator License: LGPLv2+ URL: http://developer.gnome.org/vte/ @@ -13,8 +13,6 @@ Patch0: vte-alt-meta-confusion.patch # Python bindings bugfix # https://bugzilla.redhat.com/show_bug.cgi?id=556200 Patch1: vte-python-bugfixes.patch -# limit arguments to avoid DOS -Patch2: vte-0.28.2-limit-arguments.patch # aarch64 support Patch3: vte-aarch64.patch # Fix control home/control end codes @@ -35,6 +33,10 @@ Patch8: vte-0.28.2-683730.patch # Backport extended xterm/urxvt mouse tracking support # https://bugzilla.gnome.org/show_bug.cgi?id=681329 Patch9: vte-0.28.2-mouse-tracking.patch +#http://deb.debian.org/debian/pool/main/v/vte/vte_0.28.2-6.debian.tar.xz +#https://bugzilla.gnome.org/show_bug.cgi?id=676090 +Patch10: CVE-2012-2738-1.patch +Patch11: CVE-2012-2738-2.patch BuildRequires: gtk2-devel >= %{gtk2_version} pango-devel >= %{pango_version} BuildRequires: glib2-devel >= %{glib2_version} ncurses-devel BuildRequires: gettext libXt-devel intltool perl-Carp gobject-introspection-devel @@ -55,7 +57,6 @@ vte. %setup -q %patch0 -p1 %patch1 -p1 -%patch2 -p1 %patch3 -p1 %patch4 -p1 %patch5 -p1 @@ -63,6 +64,8 @@ vte. %patch7 -p1 %patch8 -p1 %patch9 -p1 +%patch10 -p1 +%patch11 -p1 %build %configure \ @@ -103,6 +106,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/python*/site-packages/gtk-2.0/*.a %doc %{_datadir}/gtk-doc/html/vte-0.0 %changelog +* Thu Apr 14 2022 yaoxin - 0.28.2-4 +- Fix CVE-2012-2738 + * Wed Aug 18 2021 lingsheng - 0.28.2-3 - Remove require pygtk2-devel