Browse code
Fix for CVE-2018-10754
A NULL pointer dereference was found in the way the _nc_parse_entry function parses terminfo data for compilation.
Change-Id: Ibeaa1fb2ff183f5704e0192eeed3d5d7defc835c
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/5364
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
Tapas Kundu authored on 2018/07/17 23:30:06Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,18 @@ |
| 0 |
+--- a/ncurses/tinfo/parse_entry.c 2018-07-17 19:44:55.333567209 +0530 |
|
| 1 |
+@@ -543,11 +543,12 @@ |
|
| 2 |
+ * Otherwise, look for a base entry that will already |
|
| 3 |
+ * have picked up defaults via translation. |
|
| 4 |
+ */ |
|
| 5 |
+- for (i = 0; i < entryp->nuses; i++) |
|
| 6 |
+- if (!strchr((char *) entryp->uses[i].name, '+')) |
|
| 7 |
++ for (i = 0; i < entryp->nuses; i++) {
|
|
| 8 |
++ if (entryp->uses[i].name != 0 |
|
| 9 |
++ && !strchr(entryp->uses[i].name, '+')) |
|
| 10 |
+ has_base_entry = TRUE; |
|
| 11 |
++ } |
|
| 12 |
+ } |
|
| 13 |
+- |
|
| 14 |
+ postprocess_termcap(&entryp->tterm, has_base_entry); |
|
| 15 |
+ } else |
|
| 16 |
+ postprocess_terminfo(&entryp->tterm); |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
Summary: Libraries for terminal handling of character screens |
| 2 | 2 |
Name: ncurses |
| 3 | 3 |
Version: 6.0 |
| 4 |
-Release: 8%{?dist}
|
|
| 4 |
+Release: 9%{?dist}
|
|
| 5 | 5 |
License: MIT |
| 6 | 6 |
URL: http://invisible-island.net/ncurses/ |
| 7 | 7 |
Group: Applications/System |
| ... | ... |
@@ -11,6 +11,7 @@ Distribution: Photon |
| 11 | 11 |
Source0: ftp://ftp.invisible-island.net/ncurses/current/%{name}-%{version}-20171125.tgz
|
| 12 | 12 |
%define sha1 ncurses=179d79d707ac5040499294e3206fd558d52b604a |
| 13 | 13 |
Provides: libncurses.so.6()(64bit) |
| 14 |
+Patch0: CVE-2018-10754.patch |
|
| 14 | 15 |
%description |
| 15 | 16 |
The Ncurses package contains libraries for terminal-independent |
| 16 | 17 |
handling of character screens. |
| ... | ... |
@@ -32,6 +33,7 @@ Provides: pkgconfig(ncurses) |
| 32 | 32 |
It contains the libraries and header files to create applications |
| 33 | 33 |
%prep |
| 34 | 34 |
%setup -q -n %{name}-%{version}-%{ncursessubversion}
|
| 35 |
+%patch0 -p1 |
|
| 35 | 36 |
|
| 36 | 37 |
%build |
| 37 | 38 |
mkdir v6 |
| ... | ... |
@@ -155,6 +157,8 @@ ln -sv %{_lib}/libncursesw.so.5.9 %{buildroot}%{_libdir}/libncurses.so.5
|
| 155 | 155 |
%{_libdir}/libpanel.so
|
| 156 | 156 |
%{_libdir}/libmenu.so
|
| 157 | 157 |
%changelog |
| 158 |
+* Tue Jul 17 2018 Tapas Kundu <tkundu@vmware.com> 6.0-9 |
|
| 159 |
+- Fix for CVE-2018-10754 |
|
| 158 | 160 |
* Wed Dec 06 2017 Xiaolin Li <xiaolinl@vmware.com> 6.0-8 |
| 159 | 161 |
- version bump to 20171125, fix CVE-2017-16879 |
| 160 | 162 |
* Tue Oct 17 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 6.0-7 |