Date: Tue, 17 Oct 2017 20:29:32 +0000 (UTC) From: Niclas Zeising <zeising@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r452308 - in head/x11-wm/spectrwm: . files Message-ID: <201710172029.v9HKTWXG027314@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: zeising Date: Tue Oct 17 20:29:32 2017 New Revision: 452308 URL: https://svnweb.freebsd.org/changeset/ports/452308 Log: Fix out of bounds memory read when reading bar input. Add patch from upstream git that fixes an out of bounds read and possible write if the bar action script returns a NULL as the first character. It is unclear if this can cause any security issues, but I feel it's prudent to fix the issue. MFH: 2017Q4 Added: head/x11-wm/spectrwm/files/ea3e6da-oob-fix.patch (contents, props changed) Modified: head/x11-wm/spectrwm/Makefile Modified: head/x11-wm/spectrwm/Makefile ============================================================================== --- head/x11-wm/spectrwm/Makefile Tue Oct 17 20:17:17 2017 (r452307) +++ head/x11-wm/spectrwm/Makefile Tue Oct 17 20:29:32 2017 (r452308) @@ -4,6 +4,7 @@ PORTNAME= spectrwm DISTVERSIONPREFIX= SPECTRWM_ DISTVERSION= 3_1_0 +PORTREVISION= 1 CATEGORIES= x11-wm MAINTAINER= zeising@FreeBSD.org @@ -35,6 +36,8 @@ CONFEXAMPLES= spectrwm_cz.conf \ SCRIPTEXAMPLES= baraction.sh \ screenshot.sh + +EXTRA_PATCHES= ${FILESDIR}/ea3e6da-oob-fix.patch post-patch: @${REINPLACE_CMD} -e 's|/etc/|${PREFIX}/etc/|g' ${WRKSRC}/spectrwm.* Added: head/x11-wm/spectrwm/files/ea3e6da-oob-fix.patch ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/x11-wm/spectrwm/files/ea3e6da-oob-fix.patch Tue Oct 17 20:29:32 2017 (r452308) @@ -0,0 +1,30 @@ +From ea3e6da62247572e92c4ba00f70eab73f6254adf Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann <tobias@stoeckmann.org> +Date: Sat, 14 Oct 2017 10:22:31 +0200 +Subject: [PATCH] Fix OOB while reading bar input. + +If the status bar script returns NUL as the first character through +stdin, spectrwm is prone to an out of boundary access. Depending on +the memory layout of the machine, it could turn into an OOB write. + +The fix is simple: If the string is empty, do not further check for +newline character. + +Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> +--- + spectrwm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/spectrwm.c b/spectrwm.c +index 9d3ec23..9b0ad2c 100644 +--- spectrwm.c ++++ spectrwm.c +@@ -2761,7 +2761,7 @@ bar_extra_update(void) + while (fgets(b, sizeof(b), stdin) != NULL) { + if (bar_enabled) { + len = strlen(b); +- if (b[len - 1] == '\n') { ++ if (len > 0 && b[len - 1] == '\n') { + /* Remove newline. */ + b[--len] = '\0'; +
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201710172029.v9HKTWXG027314>