aboutsummaryrefslogtreecommitdiff
path: root/misc/screen/files
diff options
context:
space:
mode:
authorCy Schubert <cy@FreeBSD.org>2003-12-02 23:36:47 +0000
committerCy Schubert <cy@FreeBSD.org>2003-12-02 23:36:47 +0000
commit15d50ff35c5fc6139209ec6d11d8d8e2b1519a45 (patch)
treeaf9a052ffa4bc463d8bdd319f33ba203d73187a1 /misc/screen/files
parentabec811fec226bcab816705a541516cb3ae6a189 (diff)
downloadports-15d50ff35c5fc6139209ec6d11d8d8e2b1519a45.tar.gz
ports-15d50ff35c5fc6139209ec6d11d8d8e2b1519a45.zip
Fix buffer overflow that allows privilege escalation for local users.
Approved by: will (using his portmgr hat) Obtained from: Timo Sirainen <tss@iki.fi> on BUGTRAQ
Notes
Notes: svn path=/head/; revision=94846
Diffstat (limited to 'misc/screen/files')
-rw-r--r--misc/screen/files/patch-ansi.c11
-rw-r--r--misc/screen/files/patch-resize.c20
2 files changed, 31 insertions, 0 deletions
diff --git a/misc/screen/files/patch-ansi.c b/misc/screen/files/patch-ansi.c
new file mode 100644
index 000000000000..dc5ba91b521a
--- /dev/null
+++ b/misc/screen/files/patch-ansi.c
@@ -0,0 +1,11 @@
+--- ansi.c.orig Mon Sep 8 07:24:44 2003
++++ ansi.c Mon Dec 1 17:17:17 2003
+@@ -559,7 +559,7 @@
+ {
+ case '0': case '1': case '2': case '3': case '4':
+ case '5': case '6': case '7': case '8': case '9':
+- if (curr->w_NumArgs < MAXARGS)
++ if (curr->w_NumArgs >= 0 && curr->w_NumArgs < MAXARGS)
+ {
+ if (curr->w_args[curr->w_NumArgs] < 100000000)
+ curr->w_args[curr->w_NumArgs] =
diff --git a/misc/screen/files/patch-resize.c b/misc/screen/files/patch-resize.c
new file mode 100644
index 000000000000..a2af125f12ff
--- /dev/null
+++ b/misc/screen/files/patch-resize.c
@@ -0,0 +1,20 @@
+--- resize.c.orig Mon Sep 8 07:26:31 2003
++++ resize.c Mon Dec 1 17:16:29 2003
+@@ -682,6 +682,17 @@
+ if (wi == 0)
+ he = hi = 0;
+
++ if (wi > 1000)
++ {
++ Msg(0, "Window width too large, truncated");
++ wi = 1000;
++ }
++ if (he > 1000)
++ {
++ Msg(0, "Window height too large, truncated");
++ he = 1000;
++ }
++
+ if (p->w_width == wi && p->w_height == he && p->w_histheight == hi)
+ {
+ debug("ChangeWindowSize: No change.\n");