Commit f647940e authored by Leo's avatar Leo
Browse files

main/tmux: fix CVE-2020-27347

See: #12094
parent dd335d7b
Pipeline #57903 passed with stages
in 6 minutes and 21 seconds
......@@ -2,7 +2,7 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=tmux
pkgver=2.9a
pkgrel=1
pkgrel=2
pkgdesc="Tool to control multiple terminals from a single terminal"
url="https://tmux.github.io"
arch="all"
......@@ -10,8 +10,13 @@ license="ISC"
depends="ncurses-terminfo-base"
makedepends="autoconf automake bsd-compat-headers libevent-dev ncurses-dev"
subpackages="$pkgname-doc"
source="https://github.com/tmux/tmux/releases/download/$pkgver/tmux-$pkgver.tar.gz"
source="https://github.com/tmux/tmux/releases/download/$pkgver/tmux-$pkgver.tar.gz
CVE-2020-27347.patch
"
# secfixes:
# 2.9a-r2:
# - CVE-2020-27347
build() {
./configure \
......@@ -38,4 +43,5 @@ package() {
done
}
sha512sums="aca6882688727c10c5647443fdd18bbd6c0f80b7a3bf9667903d1b89d523e604cd715f176f33f2e5673258f00e626a6dc273f80fe97ae4f91621814d89985713 tmux-2.9a.tar.gz"
sha512sums="aca6882688727c10c5647443fdd18bbd6c0f80b7a3bf9667903d1b89d523e604cd715f176f33f2e5673258f00e626a6dc273f80fe97ae4f91621814d89985713 tmux-2.9a.tar.gz
29ffcf27c9ffa2a67742732f44ba0821172746b3a824ebd8087deb9a91e437bbfdc385498c2a09c9f6e206dc57e61fe7ea65b2432b3e89af01e2f72fc0a23e89 CVE-2020-27347.patch"
From a868bacb46e3c900530bed47a1c6f85b0fbe701c Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Thu, 29 Oct 2020 16:33:01 +0000
Subject: [PATCH] Do not write after the end of the array and overwrite the
stack when colon-separated SGR sequences contain empty arguments. Reported by
Sergey Nizovtsev.
---
input.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/input.c b/input.c
index 42a60c92a..c280c0d97 100644
--- a/input.c
+++ b/input.c
@@ -1976,8 +1976,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
free(copy);
return;
}
- } else
+ } else {
n++;
+ if (n == nitems(p)) {
+ free(copy);
+ return;
+ }
+ }
log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
}
free(copy);
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment