diffstat for w3m-0.5.3 w3m-0.5.3

 changelog                    |    9 +++++++++
 patches/955_tbl-indent.patch |   24 ++++++++++++++++++++++++
 patches/956_columnpos.patch  |   18 ++++++++++++++++++
 patches/957_mkdtemp.patch    |   35 +++++++++++++++++++++++++++++++++++
 patches/series               |    3 +++
 5 files changed, 89 insertions(+)

diff -Nru w3m-0.5.3/debian/changelog w3m-0.5.3/debian/changelog
--- w3m-0.5.3/debian/changelog	2017-01-04 23:25:02.000000000 +0900
+++ w3m-0.5.3/debian/changelog	2018-01-26 18:50:05.000000000 +0900
@@ -1,3 +1,12 @@
+w3m (0.5.3-34+deb9u1) stretch; urgency=medium
+
+  * New patch 955_tbl-indent.patch to fix stack overflow [CVE-2018-6196]
+  * New patch 956_columnpos.patch to fix null deref [CVE-2018-6197]
+  * New patch 957_mkdtemp.patch to fix /tmp file races [CVE-2018-6198]
+    (closes: #888097)
+
+ -- Tatsuya Kinoshita <tats@debian.org>  Fri, 26 Jan 2018 18:50:05 +0900
+
 w3m (0.5.3-34) unstable; urgency=medium
 
   * Update 020_debian.patch to v0.5.3+git20170102
diff -Nru w3m-0.5.3/debian/patches/955_tbl-indent.patch w3m-0.5.3/debian/patches/955_tbl-indent.patch
--- w3m-0.5.3/debian/patches/955_tbl-indent.patch	1970-01-01 09:00:00.000000000 +0900
+++ w3m-0.5.3/debian/patches/955_tbl-indent.patch	2018-01-26 18:46:21.000000000 +0900
@@ -0,0 +1,24 @@
+Subject: Prevent negative indent value in feed_table_block_tag()
+From: Tatsuya Kinoshita <tats@debian.org>
+Bug-Debian: https://github.com/tats/w3m/issues/88 [CVE-2018-6196]
+Origin: https://salsa.debian.org/debian/w3m/commit/8354763b90490d4105695df52674d0fcef823e92
+
+diff --git a/table.c b/table.c
+index 221db92..4f193e1 100644
+--- a/table.c
++++ b/table.c
+@@ -2356,10 +2356,14 @@ feed_table_block_tag(struct table *tbl,
+ 	if (mode->indent_level < MAX_INDENT_LEVEL)
+ 	    tbl->indent -= INDENT_INCR;
+     }
++    if (tbl->indent < 0)
++	tbl->indent = 0;
+     offset = tbl->indent;
+     if (cmd == HTML_DT) {
+ 	if (mode->indent_level > 0 && mode->indent_level <= MAX_INDENT_LEVEL)
+ 	    offset -= INDENT_INCR;
++	if (offset < 0)
++	    offset = 0;
+     }
+     if (tbl->indent > 0) {
+ 	check_minimum0(tbl, 0);
diff -Nru w3m-0.5.3/debian/patches/956_columnpos.patch w3m-0.5.3/debian/patches/956_columnpos.patch
--- w3m-0.5.3/debian/patches/956_columnpos.patch	1970-01-01 09:00:00.000000000 +0900
+++ w3m-0.5.3/debian/patches/956_columnpos.patch	2018-01-26 18:47:48.000000000 +0900
@@ -0,0 +1,18 @@
+Subject: Prevent invalid columnPos() call in formUpdateBuffer()
+From: Tatsuya Kinoshita <tats@debian.org>
+Bug-Debian: https://github.com/tats/w3m/issues/89 [CVE-2018-6197]
+Origin: https://salsa.debian.org/debian/w3m/commit/7fdc83b0364005a0b5ed869230dd81752ba022e8
+
+diff --git a/form.c b/form.c
+index 0605513..0a71f9c 100644
+--- a/form.c
++++ b/form.c
+@@ -483,6 +483,8 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)
+ 	rows = form->rows ? form->rows : 1;
+ 	col = COLPOS(l, a->start.pos);
+ 	for (c_rows = 0; c_rows < rows; c_rows++, l = l->next) {
++	    if (l == NULL)
++		break;
+ 	    if (rows > 1) {
+ 		pos = columnPos(l, col);
+ 		a = retrieveAnchor(buf->formitem, l->linenumber, pos);
diff -Nru w3m-0.5.3/debian/patches/957_mkdtemp.patch w3m-0.5.3/debian/patches/957_mkdtemp.patch
--- w3m-0.5.3/debian/patches/957_mkdtemp.patch	1970-01-01 09:00:00.000000000 +0900
+++ w3m-0.5.3/debian/patches/957_mkdtemp.patch	2018-01-26 18:49:04.000000000 +0900
@@ -0,0 +1,35 @@
+Subject: Make temporary directory safely when ~/.w3m is unwritable
+From: Tatsuya Kinoshita <tats@debian.org>
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=888097 [CVE-2018-6198]
+Origin: https://salsa.debian.org/debian/w3m/commit/18dcbadf2771cdb0c18509b14e4e73505b242753
+
+diff --git a/main.c b/main.c
+index 85b0003..b99928c 100644
+--- a/main.c
++++ b/main.c
+@@ -5972,6 +5972,11 @@ w3m_exit(int i)
+ #ifdef __MINGW32_VERSION
+     WSACleanup();
+ #endif
++    if (no_rc_dir && tmp_dir != rc_dir)
++	if (rmdir(tmp_dir) != 0) {
++	    fprintf(stderr, "Can't remove temporary directory (%s)!\n", tmp_dir);
++	    exit(1);
++	}
+     exit(i);
+ }
+ 
+diff --git a/rc.c b/rc.c
+index 7de87b8..428241c 100644
+--- a/rc.c
++++ b/rc.c
+@@ -1330,6 +1330,9 @@ init_rc(void)
+ 	((tmp_dir = getenv("TMP")) == NULL || *tmp_dir == '\0') &&
+ 	((tmp_dir = getenv("TEMP")) == NULL || *tmp_dir == '\0'))
+ 	tmp_dir = "/tmp";
++    tmp_dir = mkdtemp(Strnew_m_charp(tmp_dir, "/w3m-XXXXXX", NULL)->ptr);
++    if (tmp_dir == NULL)
++	tmp_dir = rc_dir;
+     create_option_search_table();
+     goto open_rc;
+ }
diff -Nru w3m-0.5.3/debian/patches/series w3m-0.5.3/debian/patches/series
--- w3m-0.5.3/debian/patches/series	2017-01-04 23:11:21.000000000 +0900
+++ w3m-0.5.3/debian/patches/series	2018-01-26 18:49:12.000000000 +0900
@@ -1,2 +1,5 @@
 010_upstream.patch
 020_debian.patch
+955_tbl-indent.patch
+956_columnpos.patch
+957_mkdtemp.patch