On 2015-02-28 19:02 +0100, Thomas Dickey wrote:
> ----- Original Message -----
> | From: "Sven Joachim" <svenj...@gmx.de>
> | To: "Thomas Dickey" <dic...@his.com>
> | Cc: 779397-d...@bugs.debian.org, "Vincent Lefevre" <vinc...@vinc17.net>
> | Sent: Saturday, February 28, 2015 12:51:13 PM
> | Subject: Re: Bug#779397: xterm: buffer overflow with -S option
> |
> | Package: xterm
> | Version: 314-1
> |
> | On 2015-02-28 13:37 +0100, Thomas Dickey wrote:
> |
> | > On Sat, Feb 28, 2015 at 03:37:53AM +0100, Vincent Lefevre wrote:
> | >> Package: xterm
> | >> Version: 312-1
> | >> Severity: important
> | >> Tags: security
> | >>
> | >> $ xterm -S/dev/pts/20
> | >> *** buffer overflow detected ***: /usr/bin/xterm terminated
> | >
> | > This was fixed in #314, two months ago.
> |
> | Thanks. For the package in jessie/sid, I suppose I would have to
> | apply
> | the passedPty related changes in main.c, right?
> |
>
> yes - that is all that I changed for that fix:
>
> REV:1.763 main.c 2014/12/15 09:51:34 tom
> tags: xterm-313d
>
> change passedPty[] to an allocated string to ensure it is long enough for
> the -S option value.
>
> --- main.c 2014/07/24 22:47:09 1.762
> +++ main.c 2014/12/15 09:51:34 1.763
> @@ -1,4 +1,4 @@
> -/* $XTermId: main.c,v 1.761 2014/07/22 22:29:17 tom Exp $ */
> +/* $XTermId: main.c,v 1.762 2014/07/24 22:47:09 tom Exp $ */
>
> /*
> * Copyright 2002-2013,2014 by Thomas E. Dickey
> @@ -779,7 +779,8 @@
> static char bin_login[] = LOGIN_FILENAME;
> #endif
>
> -static char passedPty[PTYCHARLEN + 1]; /* name if pty if slave */
> +static char noPassedPty[2];
> +static char *passedPty = noPassedPty; /* name if pty if slave */
>
> #if defined(TIOCCONS) || defined(SRIOCSREDIR)
> static int Console;
> @@ -1760,6 +1761,7 @@
> char *leaf = x_basename(option);
> Bool code = False;
>
> + passedPty = x_strdup(option);
> if (leaf != option) {
> if (leaf - option > 0
> && isdigit(CharOf(*leaf))
> @@ -1771,13 +1773,13 @@
> * the /dev/pts/XXX value, but since we do not need to reopen it,
> * it is useful mainly for display in a "ps -ef".
> */
> - strncpy(passedPty, option, len);
> passedPty[len] = 0;
> code = True;
> }
> } else {
> code = (sscanf(option, "%c%c%d",
> passedPty, passedPty + 1, &am_slave) == 3);
> + passedPty[2] = '\0';
> }
> TRACE(("ParseSccn(%s) = '%s' %d (%s)\n", option,
> passedPty, am_slave, code ? "OK" : "ERR"));
Thanks, I will prepare an upload tomorrow.
Cheers,
Sven
--
To UNSUBSCRIBE, email to debian-x-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87a8zx51er....@turtle.gmx.de
