!8 [sync] PR-5: Fix CVE-2012-2738
From: @openeuler-sync-bot Reviewed-by: @small_leek Signed-off-by: @small_leek
This commit is contained in:
openeuler-ci-bot
Gitee
commit
6895e702f6
82
CVE-2012-2738-2.patch
Normal file
82
CVE-2012-2738-2.patch
Normal file
@ -0,0 +1,82 @@
|
||||
From 98ce2f265f986fb88c38d508286bb5e3716b9e74 Mon Sep 17 00:00:00 2001
|
||||
From: Christian Persch <chpe@gnome.org>
|
||||
Date: Sat, 19 May 2012 18:04:12 +0000
|
||||
Subject: emulation: Limit repetitions
|
||||
|
||||
Don't allow malicious sequences to cause excessive repetitions.
|
||||
|
||||
https://bugzilla.gnome.org/show_bug.cgi?id=676090
|
||||
---
|
||||
diff --git a/src/vteseq.c b/src/vteseq.c
|
||||
index 46def5b..7fb4707 100644
|
||||
--- a/src/vteseq.c
|
||||
+++ b/src/vteseq.c
|
||||
@@ -1397,7 +1397,7 @@ vte_sequence_handler_dc (VteTerminal *terminal, GValueArray *params)
|
||||
static void
|
||||
vte_sequence_handler_DC (VteTerminal *terminal, GValueArray *params)
|
||||
{
|
||||
- vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_dc);
|
||||
+ vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_dc);
|
||||
}
|
||||
|
||||
/* Delete a line at the current cursor position. */
|
||||
@@ -1790,7 +1790,7 @@ vte_sequence_handler_reverse_index (VteTerminal *terminal, GValueArray *params)
|
||||
static void
|
||||
vte_sequence_handler_RI (VteTerminal *terminal, GValueArray *params)
|
||||
{
|
||||
- vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_nd);
|
||||
+ vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_nd);
|
||||
}
|
||||
|
||||
/* Save cursor (position). */
|
||||
@@ -2782,8 +2782,7 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
|
||||
{
|
||||
GValue *value;
|
||||
VteScreen *screen;
|
||||
- long param, end, row;
|
||||
- int i;
|
||||
+ long param, end, row, i, limit;
|
||||
screen = terminal->pvt->screen;
|
||||
/* The default is one. */
|
||||
param = 1;
|
||||
@@ -2801,7 +2800,13 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
|
||||
} else {
|
||||
end = screen->insert_delta + terminal->row_count - 1;
|
||||
}
|
||||
- /* Insert the new lines at the cursor. */
|
||||
+
|
||||
+ /* Only allow to insert as many lines as there are between this row
|
||||
+ * and the end of the scrolling region. See bug #676090.
|
||||
+ */
|
||||
+ limit = end - row + 1;
|
||||
+ param = MIN (param, limit);
|
||||
+
|
||||
for (i = 0; i < param; i++) {
|
||||
/* Clear a line off the end of the region and add one to the
|
||||
* top of the region. */
|
||||
@@ -2822,8 +2827,7 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
|
||||
{
|
||||
GValue *value;
|
||||
VteScreen *screen;
|
||||
- long param, end, row;
|
||||
- int i;
|
||||
+ long param, end, row, i, limit;
|
||||
|
||||
screen = terminal->pvt->screen;
|
||||
/* The default is one. */
|
||||
@@ -2842,6 +2846,13 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
|
||||
} else {
|
||||
end = screen->insert_delta + terminal->row_count - 1;
|
||||
}
|
||||
+
|
||||
+ /* Only allow to delete as many lines as there are between this row
|
||||
+ * and the end of the scrolling region. See bug #676090.
|
||||
+ */
|
||||
+ limit = end - row + 1;
|
||||
+ param = MIN (param, limit);
|
||||
+
|
||||
/* Clear them from below the current cursor. */
|
||||
for (i = 0; i < param; i++) {
|
||||
/* Insert a line at the end of the region and remove one from
|
||||
--
|
||||
cgit v0.9.0.2
|
||||
14
vte.spec
14
vte.spec
@ -3,7 +3,7 @@
|
||||
%define gtk2_version 2.20.0
|
||||
Name: vte
|
||||
Version: 0.28.2
|
||||
Release: 3
|
||||
Release: 4
|
||||
Summary: A terminal emulator
|
||||
License: LGPLv2+
|
||||
URL: http://developer.gnome.org/vte/
|
||||
@ -13,8 +13,6 @@ Patch0: vte-alt-meta-confusion.patch
|
||||
# Python bindings bugfix
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=556200
|
||||
Patch1: vte-python-bugfixes.patch
|
||||
# limit arguments to avoid DOS
|
||||
Patch2: vte-0.28.2-limit-arguments.patch
|
||||
# aarch64 support
|
||||
Patch3: vte-aarch64.patch
|
||||
# Fix control home/control end codes
|
||||
@ -35,6 +33,10 @@ Patch8: vte-0.28.2-683730.patch
|
||||
# Backport extended xterm/urxvt mouse tracking support
|
||||
# https://bugzilla.gnome.org/show_bug.cgi?id=681329
|
||||
Patch9: vte-0.28.2-mouse-tracking.patch
|
||||
#http://deb.debian.org/debian/pool/main/v/vte/vte_0.28.2-6.debian.tar.xz
|
||||
#https://bugzilla.gnome.org/show_bug.cgi?id=676090
|
||||
Patch10: CVE-2012-2738-1.patch
|
||||
Patch11: CVE-2012-2738-2.patch
|
||||
BuildRequires: gtk2-devel >= %{gtk2_version} pango-devel >= %{pango_version}
|
||||
BuildRequires: glib2-devel >= %{glib2_version} ncurses-devel
|
||||
BuildRequires: gettext libXt-devel intltool perl-Carp gobject-introspection-devel
|
||||
@ -55,7 +57,6 @@ vte.
|
||||
%setup -q
|
||||
%patch0 -p1
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
@ -63,6 +64,8 @@ vte.
|
||||
%patch7 -p1
|
||||
%patch8 -p1
|
||||
%patch9 -p1
|
||||
%patch10 -p1
|
||||
%patch11 -p1
|
||||
|
||||
%build
|
||||
%configure \
|
||||
@ -103,6 +106,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/python*/site-packages/gtk-2.0/*.a
|
||||
%doc %{_datadir}/gtk-doc/html/vte-0.0
|
||||
|
||||
%changelog
|
||||
* Thu Apr 14 2022 yaoxin <yaoxin30@h-partners.com> - 0.28.2-4
|
||||
- Fix CVE-2012-2738
|
||||
|
||||
* Wed Aug 18 2021 lingsheng <lingsheng@huawei.com> - 0.28.2-3
|
||||
- Remove require pygtk2-devel
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user