!8 [sync] PR-5: Fix CVE-2012-2738

From: @openeuler-sync-bot 
Reviewed-by: @small_leek 
Signed-off-by: @small_leek

CVE-2012-2738-2.patch

@@ -0,0 +1,82 @@
+From 98ce2f265f986fb88c38d508286bb5e3716b9e74 Mon Sep 17 00:00:00 2001
+From: Christian Persch <chpe@gnome.org>
+Date: Sat, 19 May 2012 18:04:12 +0000
+Subject: emulation: Limit repetitions
+
+Don't allow malicious sequences to cause excessive repetitions.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=676090
+---
+diff --git a/src/vteseq.c b/src/vteseq.c
+index 46def5b..7fb4707 100644
+--- a/src/vteseq.c
++++ b/src/vteseq.c
+@@ -1397,7 +1397,7 @@ vte_sequence_handler_dc (VteTerminal *terminal, GValueArray *params)
+ static void
+ vte_sequence_handler_DC (VteTerminal *terminal, GValueArray *params)
+ {
+-	vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_dc);
++	vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_dc);
+ }
+ 
+ /* Delete a line at the current cursor position. */
+@@ -1790,7 +1790,7 @@ vte_sequence_handler_reverse_index (VteTerminal *terminal, GValueArray *params)
+ static void
+ vte_sequence_handler_RI (VteTerminal *terminal, GValueArray *params)
+ {
+-	vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_nd);
++	vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_nd);
+ }
+ 
+ /* Save cursor (position). */
+@@ -2782,8 +2782,7 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
+ {
+ 	GValue *value;
+ 	VteScreen *screen;
+-	long param, end, row;
+-	int i;
++	long param, end, row, i, limit;
+ 	screen = terminal->pvt->screen;
+ 	/* The default is one. */
+ 	param = 1;
+@@ -2801,7 +2800,13 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
+ 	} else {
+ 		end = screen->insert_delta + terminal->row_count - 1;
+ 	}
+-	/* Insert the new lines at the cursor. */
++
++	/* Only allow to insert as many lines as there are between this row
++         * and the end of the scrolling region. See bug #676090.
++         */
++        limit = end - row + 1;
++        param = MIN (param, limit);
++
+ 	for (i = 0; i < param; i++) {
+ 		/* Clear a line off the end of the region and add one to the
+ 		 * top of the region. */
+@@ -2822,8 +2827,7 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
+ {
+ 	GValue *value;
+ 	VteScreen *screen;
+-	long param, end, row;
+-	int i;
++	long param, end, row, i, limit;
+ 
+ 	screen = terminal->pvt->screen;
+ 	/* The default is one. */
+@@ -2842,6 +2846,13 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
+ 	} else {
+ 		end = screen->insert_delta + terminal->row_count - 1;
+ 	}
++
++        /* Only allow to delete as many lines as there are between this row
++         * and the end of the scrolling region. See bug #676090.
++         */
++        limit = end - row + 1;
++        param = MIN (param, limit);
++
+ 	/* Clear them from below the current cursor. */
+ 	for (i = 0; i < param; i++) {
+ 		/* Insert a line at the end of the region and remove one from
+--
+cgit v0.9.0.2

vte.spec

@@ -3,7 +3,7 @@
 %define gtk2_version 2.20.0
 Name:                vte
 Version:             0.28.2
-Release:             3
+Release:             4
 Summary:             A terminal emulator
 License:             LGPLv2+
 URL:                 http://developer.gnome.org/vte/
@@ -13,8 +13,6 @@ Patch0:              vte-alt-meta-confusion.patch
 # Python bindings bugfix
 # https://bugzilla.redhat.com/show_bug.cgi?id=556200
 Patch1:              vte-python-bugfixes.patch
-# limit arguments to avoid DOS
-Patch2:              vte-0.28.2-limit-arguments.patch
 # aarch64 support
 Patch3:              vte-aarch64.patch
 # Fix control home/control end codes
@@ -35,6 +33,10 @@ Patch8:              vte-0.28.2-683730.patch
 # Backport extended xterm/urxvt mouse tracking support
 # https://bugzilla.gnome.org/show_bug.cgi?id=681329
 Patch9:              vte-0.28.2-mouse-tracking.patch
+#http://deb.debian.org/debian/pool/main/v/vte/vte_0.28.2-6.debian.tar.xz
+#https://bugzilla.gnome.org/show_bug.cgi?id=676090
+Patch10:             CVE-2012-2738-1.patch
+Patch11:             CVE-2012-2738-2.patch
 BuildRequires:       gtk2-devel >= %{gtk2_version} pango-devel >= %{pango_version}
 BuildRequires:       glib2-devel >= %{glib2_version} ncurses-devel
 BuildRequires:       gettext libXt-devel intltool perl-Carp gobject-introspection-devel
@@ -55,7 +57,6 @@ vte.
 %setup -q
 %patch0 -p1
 %patch1 -p1
-%patch2 -p1
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
@@ -63,6 +64,8 @@ vte.
 %patch7 -p1
 %patch8 -p1
 %patch9 -p1
+%patch10 -p1
+%patch11 -p1
 
 %build
 %configure \
@@ -103,6 +106,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/python*/site-packages/gtk-2.0/*.a
 %doc %{_datadir}/gtk-doc/html/vte-0.0
 
 %changelog
+* Thu Apr 14 2022 yaoxin <yaoxin30@h-partners.com> - 0.28.2-4
+- Fix CVE-2012-2738
+
 * Wed Aug 18 2021 lingsheng <lingsheng@huawei.com> - 0.28.2-3
 - Remove require pygtk2-devel