1. photon
  2. Commit 283f481a19a451a6826744c57ccf864e204982cd
Browse code

Fix for CVE-2017-10684 and CVE-2017-10685

Change-Id: Idac04fbd156320f576ff27d61da623f28772db35
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/3179
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>

DheerajSShetty authored on 2017/07/07 09:56:46
Showing 2 changed files
SPECS/ncurses/CVE-2017-10684-CVE-2017-10685.patch
History View file @ 283f481
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,156 @@
0 
+diff -dupr a/ncurses/tinfo/alloc_entry.c b/ncurses/tinfo/alloc_entry.c
1 
+--- a/ncurses/tinfo/alloc_entry.c	2013-08-17 12:20:38.000000000 -0700
2 
+@@ -96,7 +96,11 @@ _nc_save_str(const char *const string)
3 
+ {
4 
+     char *result = 0;
5 
+     size_t old_next_free = next_free;
6 
+-    size_t len = strlen(string) + 1;
7 
++    size_t len;
8 
++
9 
++    if (string == 0)
10 
++	return _nc_save_str("");
11 
++    len = strlen(string) + 1;
12 
+
13 
+     if (len == 1 && next_free != 0) {
14 
+ 	/*
15 
+diff -dupr a/ncurses/tinfo/parse_entry.c b/ncurses/tinfo/parse_entry.c
16 
+--- a/ncurses/tinfo/parse_entry.c	2015-04-04 07:18:38.000000000 -0700
17 
+@@ -236,13 +236,14 @@ _nc_parse_entry(struct entry *entryp, in
18 
+      * implemented it.  Note that the resulting terminal type was never the
19 
+      * 2-character name, but was instead the first alias after that.
20 
+      */
21 
++#define ok_TC2(s) (isgraph(UChar(s)) && (s) != '|')
22 
+     ptr = _nc_curr_token.tk_name;
23 
+     if (_nc_syntax == SYN_TERMCAP
24 
+ #if NCURSES_XNAMES
25 
+ 	&& !_nc_user_definable
26 
+ #endif
27 
+ 	) {
28 
+-	if (ptr[2] == '|') {
29 
++	if (ok_TC2(ptr[0]) && ok_TC2(ptr[1]) && (ptr[2] == '|')) {
30 
+ 	    ptr += 3;
31 
+ 	    _nc_curr_token.tk_name[2] = '\0';
32 
+ 	}
33 
+@@ -284,9 +285,11 @@ _nc_parse_entry(struct entry *entryp, in
34 
+ 	if (is_use || is_tc) {
35 
+ 	    entryp->uses[entryp->nuses].name = _nc_save_str(_nc_curr_token.tk_valstring);
36 
+ 	    entryp->uses[entryp->nuses].line = _nc_curr_line;
37 
+-	    entryp->nuses++;
38 
+-	    if (entryp->nuses > 1 && is_tc) {
39 
+-		BAD_TC_USAGE
40 
++	    if (VALID_STRING(entryp->uses[entryp->nuses].name)) {
41 
++		entryp->nuses++;
42 
++		if (entryp->nuses > 1 && is_tc) {
43 
++		    BAD_TC_USAGE
44 
++		}
45 
+ 	    }
46 
+ 	} else {
47 
+ 	    /* normal token lookup */
48 
+@@ -571,7 +574,7 @@ append_acs0(string_desc * dst, int code,
49 
+ static void
50 
+ append_acs(string_desc * dst, int code, char *src)
51 
+ {
52 
+-    if (src != 0 && strlen(src) == 1) {
53 
++    if (VALID_STRING(src) && strlen(src) == 1) {
54 
+ 	append_acs0(dst, code, *src);
55 
+     }
56 
+ }
57 
+@@ -832,15 +835,14 @@ postprocess_termcap(TERMTYPE *tp, bool h
58 
+ 	    }
59 
+
60 
+ 	    if (tp->Strings[to_ptr->nte_index]) {
61 
++		const char *s = tp->Strings[from_ptr->nte_index];
62 
++		const char *t = tp->Strings[to_ptr->nte_index];
63 
+ 		/* There's no point in warning about it if it's the same
64 
+ 		 * string; that's just an inefficiency.
65 
+ 		 */
66 
+-		if (strcmp(
67 
+-			      tp->Strings[from_ptr->nte_index],
68 
+-			      tp->Strings[to_ptr->nte_index]) != 0)
69 
++		if (VALID_STRING(s) && VALID_STRING(t) && strcmp(s, t) != 0)
70 
+ 		    _nc_warning("%s (%s) already has an explicit value %s, ignoring ko",
71 
+-				ap->to, ap->from,
72 
+-				_nc_visbuf(tp->Strings[to_ptr->nte_index]));
73 
++				ap->to, ap->from, t);
74 
+ 		continue;
75 
+ 	    }
76 
+
77 
+diff -dupr a/progs/dump_entry.c b/progs/dump_entry.c
78 
+--- a/progs/dump_entry.c	2015-07-07 01:06:39.000000000 -0700
79 
+@@ -615,9 +615,10 @@ fmt_entry(TERMTYPE *tterm,
80 
+     PredIdx num_strings = 0;
81 
+     bool outcount = 0;
82 
+
83 
+-#define WRAP_CONCAT	\
84 
+-	wrap_concat(buffer); \
85 
+-	outcount = TRUE
86 
++#define WRAP_CONCAT1(s)		wrap_concat(s); outcount = TRUE
87 
++#define WRAP_CONCAT2(a,b)	wrap_concat(a); WRAP_CONCAT1(b)
88 
++#define WRAP_CONCAT3(a,b,c)	wrap_concat(a); WRAP_CONCAT2(b,c)
89 
++#define WRAP_CONCAT		WRAP_CONCAT1(buffer)
90 
+
91 
+     len = 12;			/* terminfo file-header */
92 
+
93 
+@@ -815,13 +816,21 @@ fmt_entry(TERMTYPE *tterm,
94 
+ 			_nc_SPRINTF(buffer, _nc_SLIMIT(sizeof(buffer))
95 
+ 				    "%s=!!! %s WILL NOT CONVERT !!!",
96 
+ 				    name, srccap);
97 
++			WRAP_CONCAT;
98 
+ 		    } else if (suppress_untranslatable) {
99 
+ 			continue;
100 
+ 		    } else {
101 
+ 			char *s = srccap, *d = buffer;
102 
+-			_nc_SPRINTF(d, _nc_SLIMIT(sizeof(buffer)) "..%s=", name);
103 
+-			d += strlen(d);
104 
++			WRAP_CONCAT3("..", name, "=");
105 
+ 			while ((*d = *s++) != 0) {
106 
++			    if ((d - buffer - 1) >= (int) sizeof(buffer)) {
107 
++				fprintf(stderr,
108 
++					"%s: value for %s is too long\n",
109 
++					_nc_progname,
110 
++					name);
111 
++				*d = '\0';
112 
++				break;
113 
++			    }
114 
+ 			    if (*d == ':') {
115 
+ 				*d++ = '\\';
116 
+ 				*d = ':';
117 
+@@ -830,13 +839,12 @@ fmt_entry(TERMTYPE *tterm,
118 
+ 			    }
119 
+ 			    d++;
120 
+ 			}
121 
++			WRAP_CONCAT;
122 
+ 		    }
123 
+ 		} else {
124 
+-		    _nc_SPRINTF(buffer, _nc_SLIMIT(sizeof(buffer))
125 
+-				"%s=%s", name, cv);
126 
++		    WRAP_CONCAT3(name, "=", cv);
127 
+ 		}
128 
+ 		len += (int) strlen(capability) + 1;
129 
+-		WRAP_CONCAT;
130 
+ 	    } else {
131 
+ 		char *src = _nc_tic_expand(capability,
132 
+ 					   outform == F_TERMINFO, numbers);
133 
+@@ -852,8 +860,7 @@ fmt_entry(TERMTYPE *tterm,
134 
+ 		    strcpy_DYN(&tmpbuf, src);
135 
+ 		}
136 
+ 		len += (int) strlen(capability) + 1;
137 
+-		wrap_concat(tmpbuf.text);
138 
+-		outcount = TRUE;
139 
++		WRAP_CONCAT1(tmpbuf.text);
140 
+ 	    }
141 
+ 	}
142 
+ 	/* e.g., trimmed_sgr0 */
143 
+@@ -1216,7 +1223,8 @@ dump_entry(TERMTYPE *tterm,
144 
+ 		}
145 
+ 		if (len > critlen) {
146 
+ 		    (void) fprintf(stderr,
147 
+-				   "warning: %s entry is %d bytes long\n",
148 
++				   "%s: %s entry is %d bytes long\n",
149 
++				   _nc_progname,
150 
+ 				   _nc_first_name(tterm->term_names),
151 
+ 				   len);
152 
+ 		    SHOW_WHY("# WARNING: this entry, %d bytes long, may core-dump %s libraries!\n",
SPECS/ncurses/ncurses.spec
History View file @ 283f481
... ... 
@@ -1,7 +1,7 @@
1 1 
 Summary:	Libraries for terminal handling of character screens
2 2 
 Name:		ncurses
3 3 
 Version:	6.0
4 
-Release:	8%{?dist}
4 
+Release:	9%{?dist}
5 5 
 License:	MIT
6 6 
 URL:		http://www.gnu.org/software/ncurses
7 7 
 Group:		Applications/System
... ... 
@@ -9,6 +9,7 @@ Vendor:		VMware, Inc.
9 9 
 Distribution: 	Photon
10 10 
 Source0:	ftp://ftp.gnu.org/gnu/ncurses/%{name}-%{version}.tar.gz
11 11 
 %define sha1 ncurses=acd606135a5124905da770803c05f1f20dd3b21c
12 
+Patch0:		CVE-2017-10684-CVE-2017-10685.patch
12 13 
 Requires:	ncurses-libs = %{version}-%{release}
13 14 
 %description
14 15 
 The Ncurses package contains libraries for terminal-independent
... ... 
@@ -45,6 +46,7 @@ It contains all terminfo files
45 45
46 46 
 %prep
47 47 
 %setup -q
48 
+%patch0 -p1
48 49 
 %build
49 50 
 mkdir v6
50 51 
 pushd v6
... ... 
@@ -180,6 +182,8 @@ make
180 180 
 %exclude %{_datadir}/terminfo/l/linux
181 181
182 182 
 %changelog
183 
+*   Thu Jul 06 2017 Dheeraj Shetty <dheerajs@vmware.com> 6.0-9
184 
+-   Fix for CVE-2017-10684 and CVE-2017-10685
183 185 
 *   Mon Jun 05 2017 Bo Gan <ganb@vmware.com> 6.0-8
184 186 
 -   Fix bash dependency
185 187 
 *   Sun Jun 04 2017 Bo Gan <ganb@vmware.com> 6.0-7