CVE-2022-29458.patch 1.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051
  1. diff --git a/ncurses/tinfo/read_entry.c b/ncurses/tinfo/read_entry.c
  2. index 41ef0d0aa..66e3d31ee 100644
  3. --- a/ncurses/tinfo/read_entry.c
  4. +++ b/ncurses/tinfo/read_entry.c
  5. @@ -1,5 +1,5 @@
  6. /****************************************************************************
  7. - * Copyright 2018-2020,2021 Thomas E. Dickey *
  8. + * Copyright 2018-2021,2022 Thomas E. Dickey *
  9. * Copyright 1998-2016,2017 Free Software Foundation, Inc. *
  10. * *
  11. * Permission is hereby granted, free of charge, to any person obtaining a *
  12. @@ -42,7 +42,7 @@
  13. #include <tic.h>
  14. -MODULE_ID("$Id: read_entry.c,v 1.161 2021/06/26 19:43:17 tom Exp $")
  15. +MODULE_ID("$Id: read_entry.c,v 1.162 2022/04/16 21:00:00 tom Exp $")
  16. #define TYPE_CALLOC(type,elts) typeCalloc(type, (unsigned)(elts))
  17. @@ -145,6 +145,7 @@ convert_strings(char *buf, char **Strings, int count, int size, char *table)
  18. {
  19. int i;
  20. char *p;
  21. + bool corrupt = FALSE;
  22. for (i = 0; i < count; i++) {
  23. if (IS_NEG1(buf + 2 * i)) {
  24. @@ -154,8 +155,20 @@ convert_strings(char *buf, char **Strings, int count, int size, char *table)
  25. } else if (MyNumber(buf + 2 * i) > size) {
  26. Strings[i] = ABSENT_STRING;
  27. } else {
  28. - Strings[i] = (MyNumber(buf + 2 * i) + table);
  29. - TR(TRACE_DATABASE, ("Strings[%d] = %s", i, _nc_visbuf(Strings[i])));
  30. + int nn = MyNumber(buf + 2 * i);
  31. + if (nn >= 0 && nn < size) {
  32. + Strings[i] = (nn + table);
  33. + TR(TRACE_DATABASE, ("Strings[%d] = %s", i,
  34. + _nc_visbuf(Strings[i])));
  35. + } else {
  36. + if (!corrupt) {
  37. + corrupt = TRUE;
  38. + TR(TRACE_DATABASE,
  39. + ("ignore out-of-range index %d to Strings[]", nn));
  40. + _nc_warning("corrupt data found in convert_strings");
  41. + }
  42. + Strings[i] = ABSENT_STRING;
  43. + }
  44. }
  45. /* make sure all strings are NUL terminated */