[Midnightbsd-cvs] mports [20960] trunk/sysutils/screen: add a security patch to screen.

[laffer1 at midnightbsd.org]

Revision: 20960
          http://svnweb.midnightbsd.org/mports/?rev=20960
Author:   laffer1
Date:     2016-02-02 22:41:35 -0500 (Tue, 02 Feb 2016)
Log Message:
-----------
add a security patch to screen.

Modified Paths:
--------------
    trunk/sysutils/screen/Makefile
    trunk/sysutils/screen/files/patch-Makefile.in

Added Paths:
-----------
    trunk/sysutils/screen/files/patch-CVE-2015-6806

Modified: trunk/sysutils/screen/Makefile
===================================================================
--- trunk/sysutils/screen/Makefile	2016-02-03 03:21:07 UTC (rev 20959)
+++ trunk/sysutils/screen/Makefile	2016-02-03 03:41:35 UTC (rev 20960)
@@ -2,7 +2,7 @@
 
 PORTNAME=	screen
 PORTVERSION=	4.3.1
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	sysutils
 MASTER_SITES=	http://ftp.gnu.org/gnu/screen/ \
 		ftp://ftp.gnu.org/gnu/screen/ \
@@ -34,7 +34,7 @@
 
 OPTIONS_SUB=
 
-USES=		gmake cpe
+USES=		gmake cpe ncurses
 
 CPE_VENDOR=	gnu
 

Added: trunk/sysutils/screen/files/patch-CVE-2015-6806
===================================================================
--- trunk/sysutils/screen/files/patch-CVE-2015-6806	                        (rev 0)
+++ trunk/sysutils/screen/files/patch-CVE-2015-6806	2016-02-03 03:41:35 UTC (rev 20960)
@@ -0,0 +1,55 @@
+From b7484c224738247b510ed0d268cd577076958f1b Mon Sep 17 00:00:00 2001
+From: Kuang-che Wu <kcwu at csie.org>
+Date: Mon, 31 Aug 2015 17:49:57 +0000
+Subject: Fix stack overflow due to too deep recursion
+
+Bug: 45713
+
+How to reproduce:
+Run this command inside screen
+$ printf '\x1b[10000000T'
+
+screen will recursively call MScrollV to depth n/256. This is time consuming and will overflow stack if n is huge.
+---
+diff --git a/src/ansi.c b/src/ansi.c
+index a342fb1..152d2ef 100644
+--- ansi.c
++++ ansi.c
+@@ -2502,13 +2502,13 @@ int n, ys, ye, bce;
+     return;
+   if (n > 0)
+     {
++      if (ye - ys + 1 < n)
++	n = ye - ys + 1;
+       if (n > 256)
+ 	{
+ 	  MScrollV(p, n - 256, ys, ye, bce);
+ 	  n = 256;
+ 	}
+-      if (ye - ys + 1 < n)
+-	n = ye - ys + 1;
+ #ifdef COPY_PASTE
+       if (compacthist)
+ 	{
+@@ -2562,14 +2562,14 @@ int n, ys, ye, bce;
+     }
+   else
+     {
+-      if (n < -256)
+-	{
+-	  MScrollV(p, n + 256, ys, ye, bce);
+-	  n = -256;
+-	}
+       n = -n;
+       if (ye - ys + 1 < n)
+ 	n = ye - ys + 1;
++      if (n > 256)
++	{
++	  MScrollV(p, - (n - 256), ys, ye, bce);
++	  n = 256;
++	}
+ 
+       ml = p->w_mlines + ye;
+       /* Clear lines */
+--
+cgit v0.9.0.2


Property changes on: trunk/sysutils/screen/files/patch-CVE-2015-6806
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Modified: trunk/sysutils/screen/files/patch-Makefile.in
===================================================================
--- trunk/sysutils/screen/files/patch-Makefile.in	2016-02-03 03:21:07 UTC (rev 20959)
+++ trunk/sysutils/screen/files/patch-Makefile.in	2016-02-03 03:41:35 UTC (rev 20960)
@@ -1,6 +1,6 @@
---- Makefile.in.orig	2014-04-26 03:58:35.000000000 -0700
-+++ Makefile.in	2014-04-29 18:55:12.050906602 -0700
-@@ -83,19 +83,13 @@
+--- Makefile.in.orig	2015-06-28 21:22:55 UTC
++++ Makefile.in
+@@ -83,19 +83,13 @@ screen: $(OFILES)
  	    $(OPTIONS) $(CFLAGS) $<
  
  install_bin: .version screen
@@ -23,7 +23,7 @@
  	-if [ -d /usr/lib/terminfo ]; then \
  		PATH="$$PATH:/usr/5bin" tic ${srcdir}/terminfo/screeninfo.src; \
  		chmod 644 /usr/lib/terminfo/s/screen*; \
-@@ -108,7 +102,7 @@
+@@ -108,7 +102,7 @@ install: installdirs install_bin
  installdirs:
  # Path leading to ETCSCREENRC and Socketdirectory not checked.
  	$(srcdir)/etc/mkinstalldirs $(DESTDIR)$(bindir) $(DESTDIR)$(SCREENENCODINGS)
@@ -32,3 +32,17 @@
  
  uninstall: .version
  	rm -f $(DESTDIR)$(bindir)/$(SCREEN)
+@@ -350,7 +344,10 @@ layout.o: layout.h viewport.h canvas.h l
+ viewport.o: layout.h viewport.h canvas.h viewport.c config.h screen.h os.h osdef.h ansi.h acls.h \
+  comm.h layer.h term.h image.h display.h window.h extern.h \
+  braille.h
+-list_generic.o: list_generic.h list_generic.c layer.h screen.h osdef.h
+-list_display.o: list_generic.h list_display.c layer.h screen.h osdef.h
+-list_window.o: list_generic.h list_window.c window.h layer.h screen.h osdef.h
++list_generic.o: list_generic.h list_generic.c layer.h screen.h os.h osdef.h ansi.h acls.h \
++ comm.h layer.h term.h image.h display.h window.h
++list_display.o: list_generic.h list_display.c layer.h screen.h os.h osdef.h ansi.h acls.h \
++ comm.h layer.h term.h image.h display.h window.h
++list_window.o: list_generic.h list_window.c window.h layer.h screen.h os.h osdef.h ansi.h acls.h \
++ comm.h layer.h term.h image.h display.h window.h
+