diff --git a/ncurses-cve-2023-29491.patch b/ncurses-cve-2023-29491.patch new file mode 100644 index 0000000000000000000000000000000000000000..ca385c7ee1c5fd29fbaa3591d232a1863157e15e --- /dev/null +++ b/ncurses-cve-2023-29491.patch @@ -0,0 +1,27 @@ +From 9853c61fbef53c9a2ef7961025373ab62c9da694 Mon Sep 17 00:00:00 2001 +From: wangkaiqiang +Date: Wed, 20 Sep 2023 20:10:38 +0800 +Subject: [PATCH] Add judgment criteria + +Signed-off-by: wangkaiqiang +--- + ncurses/tinfo/read_entry.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/ncurses/tinfo/read_entry.c b/ncurses/tinfo/read_entry.c +index 92b5326..b798407 100644 +--- a/ncurses/tinfo/read_entry.c ++++ b/ncurses/tinfo/read_entry.c +@@ -308,6 +308,9 @@ _nc_read_termtype(TERMTYPE2 *ptr, char *buffer, int limit) + || bool_count < 0 + || num_count < 0 + || str_count < 0 ++ || bool_count > BOOLCOUNT ++ || num_count > NUMCOUNT ++ || str_count > STRCOUNT + || str_size < 0) { + returnDB(TGETENT_NO); + } +-- +2.31.1 + diff --git a/ncurses.spec b/ncurses.spec index 6ff475437d9ef384dee4e4a9addc72fe2a1fab5d..7a2d64b3a1451ebc77f7807f745044e52cfa3ac6 100644 --- a/ncurses.spec +++ b/ncurses.spec @@ -3,7 +3,7 @@ Summary: Ncurses support utilities Name: ncurses Version: 6.1 -Release: 9.%{revision}%{anolis_release}%{?dist} +Release: 10.%{revision}%{anolis_release}%{?dist} License: MIT Group: System Environment/Base URL: https://invisible-island.net/ncurses/ncurses.html @@ -17,6 +17,7 @@ Patch12: ncurses-kbs.patch Patch13: ncurses-cve-2019-17594.patch Patch14: ncurses-cve-2019-17595.patch Patch15: ncurses-tputx.patch +Patch16: ncurses-cve-2023-29491.patch BuildRequires: gcc gcc-c++ gpm-devel pkgconfig Requires: %{name}-libs%{?_isa} = %{version}-%{release} @@ -134,6 +135,7 @@ The ncurses-static package includes static libraries of the ncurses library. %patch13 -p1 -b .cve-2019-17594 %patch14 -p1 -b .cve-2019-17595 %patch15 -p1 -b .tputx +%patch16 -p1 -b .cve-2023-29491 for f in ANNOUNCE; do iconv -f iso8859-1 -t utf8 -o ${f}{_,} && @@ -304,6 +306,9 @@ bzip2 NEWS %{_libdir}/lib*.a %changelog +* Wed Sep 20 2023 Wang Kaiqiang - 6.1-10.20180224.0.1 +- Add judgment criteria (CVE-2023-29491) + * Wed Aug 11 2021 zhangwenlong - 6.1-9.20180224.0.1 - Support loongarch64