1*4882a593SmuzhiyunDescription: [CVE-2021-26937] Fix out of bounds array access 2*4882a593SmuzhiyunAuthor: Michael Schröder <mls@suse.de> 3*4882a593SmuzhiyunBug-Debian: https://bugs.debian.org/982435 4*4882a593SmuzhiyunBug: https://savannah.gnu.org/bugs/?60030 5*4882a593SmuzhiyunBug: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html 6*4882a593SmuzhiyunBug-OSS-Security: https://www.openwall.com/lists/oss-security/2021/02/09/3 7*4882a593SmuzhiyunOrigin: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00010.html 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunDownloaded from Debian: 10*4882a593Smuzhiyunhttps://sources.debian.org/data/main/s/screen/4.8.0-5/debian/patches/99_CVE-2021-26937.patch 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunSigned-off-by: Peter Korsgaard <peter@korsgaard.com> 13*4882a593Smuzhiyun--- a/encoding.c 14*4882a593Smuzhiyun+++ b/encoding.c 15*4882a593Smuzhiyun@@ -43,7 +43,7 @@ 16*4882a593Smuzhiyun # ifdef UTF8 17*4882a593Smuzhiyun static int recode_char __P((int, int, int)); 18*4882a593Smuzhiyun static int recode_char_to_encoding __P((int, int)); 19*4882a593Smuzhiyun-static void comb_tofront __P((int, int)); 20*4882a593Smuzhiyun+static void comb_tofront __P((int)); 21*4882a593Smuzhiyun # ifdef DW_CHARS 22*4882a593Smuzhiyun static int recode_char_dw __P((int, int *, int, int)); 23*4882a593Smuzhiyun static int recode_char_dw_to_encoding __P((int, int *, int)); 24*4882a593Smuzhiyun@@ -1263,6 +1263,8 @@ 25*4882a593Smuzhiyun {0x30000, 0x3FFFD}, 26*4882a593Smuzhiyun }; 27*4882a593Smuzhiyun 28*4882a593Smuzhiyun+ if (c >= 0xdf00 && c <= 0xdfff) 29*4882a593Smuzhiyun+ return 1; /* dw combining sequence */ 30*4882a593Smuzhiyun return ((bisearch(c, wide, sizeof(wide) / sizeof(struct interval) - 1)) || 31*4882a593Smuzhiyun (cjkwidth && 32*4882a593Smuzhiyun bisearch(c, ambiguous, 33*4882a593Smuzhiyun@@ -1330,11 +1332,12 @@ 34*4882a593Smuzhiyun } 35*4882a593Smuzhiyun 36*4882a593Smuzhiyun static void 37*4882a593Smuzhiyun-comb_tofront(root, i) 38*4882a593Smuzhiyun-int root, i; 39*4882a593Smuzhiyun+comb_tofront(i) 40*4882a593Smuzhiyun+int i; 41*4882a593Smuzhiyun { 42*4882a593Smuzhiyun for (;;) 43*4882a593Smuzhiyun { 44*4882a593Smuzhiyun+ int root = i >= 0x700 ? 0x801 : 0x800; 45*4882a593Smuzhiyun debug1("bring to front: %x\n", i); 46*4882a593Smuzhiyun combchars[combchars[i]->prev]->next = combchars[i]->next; 47*4882a593Smuzhiyun combchars[combchars[i]->next]->prev = combchars[i]->prev; 48*4882a593Smuzhiyun@@ -1396,9 +1399,9 @@ 49*4882a593Smuzhiyun { 50*4882a593Smuzhiyun /* full, recycle old entry */ 51*4882a593Smuzhiyun if (c1 >= 0xd800 && c1 < 0xe000) 52*4882a593Smuzhiyun- comb_tofront(root, c1 - 0xd800); 53*4882a593Smuzhiyun+ comb_tofront(c1 - 0xd800); 54*4882a593Smuzhiyun i = combchars[root]->prev; 55*4882a593Smuzhiyun- if (c1 == i + 0xd800) 56*4882a593Smuzhiyun+ if (i == 0x800 || i == 0x801 || c1 == i + 0xd800) 57*4882a593Smuzhiyun { 58*4882a593Smuzhiyun /* completely full, can't recycle */ 59*4882a593Smuzhiyun debug("utf8_handle_comp: completely full!\n"); 60*4882a593Smuzhiyun@@ -1422,7 +1425,7 @@ 61*4882a593Smuzhiyun mc->font = (i >> 8) + 0xd8; 62*4882a593Smuzhiyun mc->fontx = 0; 63*4882a593Smuzhiyun debug3("combinig char %x %x -> %x\n", c1, c, i + 0xd800); 64*4882a593Smuzhiyun- comb_tofront(root, i); 65*4882a593Smuzhiyun+ comb_tofront(i); 66*4882a593Smuzhiyun } 67*4882a593Smuzhiyun 68*4882a593Smuzhiyun #else /* !UTF8 */ 69