[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#984615: xterm: bug in CVE-2021-27135 patch in at least stretch



On Sat, Mar 06, 2021 at 06:07:43PM +0000, Thorsten Glaser wrote:
> Sven Joachim dixit:
> 
> >I see that this might be a problem (albeit unlikely to happen in
> >practice), however I have trouble understanding exactly where a
> >use-after-realloc bug comes into play.  Maybe Thorsten can help me fix
> >my blindness?
> 
> The next time something is selected, the code a little further
> up will check if the allocated size is sufficient, and, if so,
> use screen->selection_data which was the pre-realloc address of
> line.
> 
> >> I am glad and surprised that sid is okay and there doesn't seem to be
> 
> The code in sid completely differs (structures, variable names, etc).

The renaming (selection_size) comes from patch #338,
which looks like this item:

    Patch #338 - 2018/12/09
     * amend  solution  for  Debian  #758633  to  ensure that replies for
       bracketed  paste  are  not  sent  while processing a selection for
       exec-formatted (Debian #913237).
 
> >suggestion you could also apply the patches to the SaltTextAway()
> >function from xterm 365e.
> 
> If 365e is like 366 (currently in sid), you’ll have lots of fun due
> to the renamed everything.

366 is current.  I have some changes for 367 which I'll put out after
seeing what I can do to improve performance with fwvm active-icon.
 
> I’d rather Tom changed xterm upstream to address the realloc-failure
> difference. I know he reads Debian bugreports ;-) and he’s really
> busy so probably takes longer to respond.

it used to be the case that downstream would ask my opinion on patches
like this -- it's been a while since anyone did

-- 
Thomas E. Dickey <dickey@invisible-island.net>
https://invisible-island.net
ftp://ftp.invisible-island.net

Attachment: signature.asc
Description: PGP signature


Reply to: