CVS commit: pkgsrc/devel/ncurses

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sat Oct  9 07:52:36 UTC 2021

Modified Files:
        pkgsrc/devel/ncurses: Makefile distinfo
Added Files:
        pkgsrc/devel/ncurses/patches: patch-ncurses_tinfo_captoinfo.c

Log Message:
ncurses: fix for CVE-2021-39537 from upstream

Many thanks to Thomas Dickey for help in tracking down the bugfix patch!

PKGREVISION++


To generate a diff of this commit:
cvs rdiff -u -r1.110 -r1.111 pkgsrc/devel/ncurses/Makefile
cvs rdiff -u -r1.47 -r1.48 pkgsrc/devel/ncurses/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/ncurses/Makefile
diff -u pkgsrc/devel/ncurses/Makefile:1.110 pkgsrc/devel/ncurses/Makefile:1.111
--- pkgsrc/devel/ncurses/Makefile:1.110 Mon May 24 19:50:02 2021
+++ pkgsrc/devel/ncurses/Makefile       Sat Oct  9 07:52:36 2021
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.110 2021/05/24 19:50:02 wiz Exp $
+# $NetBSD: Makefile,v 1.111 2021/10/09 07:52:36 wiz Exp $
 
 .include "Makefile.common"
-PKGREVISION=   3
+PKGREVISION=   4
 
 COMMENT=       CRT screen handling and optimization package
 

Index: pkgsrc/devel/ncurses/distinfo
diff -u pkgsrc/devel/ncurses/distinfo:1.47 pkgsrc/devel/ncurses/distinfo:1.48
--- pkgsrc/devel/ncurses/distinfo:1.47  Thu Oct  7 13:40:36 2021
+++ pkgsrc/devel/ncurses/distinfo       Sat Oct  9 07:52:36 2021
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.47 2021/10/07 13:40:36 nia Exp $
+$NetBSD: distinfo,v 1.48 2021/10/09 07:52:36 wiz Exp $
 
 RMD160 (ncurses-6.2.tar.gz) = bedfe81f33b3e55e44d14126c9c2821d7f222701
 SHA512 (ncurses-6.2.tar.gz) = 4c1333dcc30e858e8a9525d4b9aefb60000cfc727bc4a1062bace06ffc4639ad9f6e54f6bdda0e3a0e5ea14de995f96b52b3327d9ec633608792c99a1e8d840d
@@ -9,4 +9,5 @@ SHA1 (patch-misc_run__tic.in) = a6a8dd89
 SHA1 (patch-misc_terminfo.src) = d9eede4b159358f396693141ed9d9c2a76647917
 SHA1 (patch-mk-1st.awk) = adf9d68ee565da80078cfcfa8969a4ef806d65de
 SHA1 (patch-ncurses_base_lib_initscr.c) = e514e2bb4862a2617b30c6ad715bc1c50cb76f0e
+SHA1 (patch-ncurses_tinfo_captoinfo.c) = d0c39b510b44088d5ea26be10711fc21de1d2ecd
 SHA1 (patch-ncurses_tinfo_lib_raw.c) = 5aa2d439b8f5c3ce87863095396848c923c864d0

Added files:

Index: pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c
diff -u /dev/null pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c:1.1
--- /dev/null   Sat Oct  9 07:52:36 2021
+++ pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c        Sat Oct  9 07:52:36 2021
@@ -0,0 +1,26 @@
+$NetBSD: patch-ncurses_tinfo_captoinfo.c,v 1.1 2021/10/09 07:52:36 wiz Exp $
+
+Fix for CVE-2021-39537 from upstream:
+https://github.com/ThomasDickey/ncurses-snapshots/commit/63ca9e061f4644795d6f3f559557f3e1ed8c738b#diff-7e95c7bc5f213e9be438e69a9d5d0f261a14952bcbd692f7b9014217b8047340
+
+--- ncurses/tinfo/captoinfo.c.orig     2020-02-02 23:34:34.000000000 +0000
++++ ncurses/tinfo/captoinfo.c
+@@ -216,12 +216,15 @@ cvtchar(register const char *sp)
+       }
+       break;
+     case '^':
++      len = 2;
+       c = UChar(*++sp);
+-      if (c == '?')
++        if (c == '?') {
+           c = 127;
+-      else
++        } else if (c == '\0') {
++            len = 1;
++        } else {
+           c &= 0x1f;
+-      len = 2;
++      }
+       break;
+     default:
+       c = UChar(*sp);