https://salsa.debian.org/debian/screen/-/raw/debian/4.8.0-5/debian/patches/99_CVE-2021-26937.patch

Description: [CVE-2021-26937] Fix out of bounds array access
Author: Michael Schröder <mls@suse.de>
Bug-Debian: https://bugs.debian.org/982435
Bug: https://savannah.gnu.org/bugs/?60030
Bug: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html
Bug-OSS-Security: https://www.openwall.com/lists/oss-security/2021/02/09/3
Origin: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00010.html

--- a/encoding.c
+++ b/encoding.c
@@ -43,7 +43,7 @@
 # ifdef UTF8
 static int   recode_char __P((int, int, int));
 static int   recode_char_to_encoding __P((int, int));
-static void  comb_tofront __P((int, int));
+static void  comb_tofront __P((int));
 #  ifdef DW_CHARS
 static int   recode_char_dw __P((int, int *, int, int));
 static int   recode_char_dw_to_encoding __P((int, int *, int));
@@ -1263,6 +1263,8 @@
     {0x30000, 0x3FFFD},
   };
 
+  if (c >= 0xdf00 && c <= 0xdfff)
+    return 1;          /* dw combining sequence */
   return ((bisearch(c, wide, sizeof(wide) / sizeof(struct interval) - 1)) ||
           (cjkwidth &&
            bisearch(c, ambiguous,
@@ -1330,11 +1332,12 @@
 }
 
 static void
-comb_tofront(root, i)
-int root, i;
+comb_tofront(i)
+int i;
 {
   for (;;)
     {
+      int root = i >= 0x700 ? 0x801 : 0x800;
       debug1("bring to front: %x\n", i);
       combchars[combchars[i]->prev]->next = combchars[i]->next;
       combchars[combchars[i]->next]->prev = combchars[i]->prev;
@@ -1396,9 +1399,9 @@
     {
       /* full, recycle old entry */
       if (c1 >= 0xd800 && c1 < 0xe000)
-        comb_tofront(root, c1 - 0xd800);
+        comb_tofront(c1 - 0xd800);
       i = combchars[root]->prev;
-      if (c1 == i + 0xd800)
+      if (i == 0x800 || i == 0x801 || c1 == i + 0xd800)
 	{
 	  /* completely full, can't recycle */
 	  debug("utf8_handle_comp: completely full!\n");
@@ -1422,7 +1425,7 @@
   mc->font  = (i >> 8) + 0xd8;
   mc->fontx = 0;
   debug3("combinig char %x %x -> %x\n", c1, c, i + 0xd800);
-  comb_tofront(root, i);
+  comb_tofront(i);
 }
 
 #else /* !UTF8 */
8795ba45af368bd8121a1'>nix</a>/<a href='/guix/log/nix/libutil?id=4f8d0539c70f8eb5eba8795ba45af368bd8121a1'>libutil</a>/<a href='/guix/log/nix/libutil/util.hh?id=4f8d0539c70f8eb5eba8795ba45af368bd8121a1'>util.hh</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/nix/libutil/util.hh?id=4f8d0539c70f8eb5eba8795ba45af368bd8121a1&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-12-08 22:30:07 +0100'>2020-12-08</span></td><td><a href='/guix/commit/nix/libutil/util.hh?id=2e308238ad09e9527f9b8c3ec4a90b6b05a93367'>daemon: 'Agent' constructor takes a list of environment variables.</a><span class='msg-avail'>...<span class='msg-tooltip'>* nix/libutil/util.hh (struct Agent)[Agent]: Add 'env' parameter.
* nix/libutil/util.cc (Agent::Agent): Honor it.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-09-14 15:42:55 +0200'>2020-09-14</span></td><td><a href='/guix/commit/nix/libutil/util.hh?id=ee9dff34f9317509cb2b833d07a0d5e01a36a4ae'>daemon: Move 'Agent' to libutil.</a><span class='msg-avail'>...<span class='msg-tooltip'>* nix/libstore/build.cc (DerivationGoal::tryBuildHook): Add "offload" to
'args' and pass settings.guixProgram as the first argument to
Agent::Agent.
(pathNullDevice, commonChildInit, Agent, Agent::Agent)
(Agent::~Agent): Move to...
* nix/libutil/util.cc: ... here.
* nix/libutil/util.hh (struct Agent, commonChildInit): New
declarations.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-01-12 00:19:09 +0100'>2020-01-12</span></td><td><a href='/guix/commit/nix/libutil/util.hh?id=7033c7692ccbbbad8f7b9952015de071a5588e87'>daemon: Account for deleted store files when deduplication is on.</a><span class='msg-avail'>...<span class='msg-tooltip'>Previously, a store item that is a regular file would not be accounted
for in the 'bytesFreed' value computed by 'deletePath' because its
'st_nlink' count would always be &gt;= 2.  This commit fixes that.

* nix/libutil/util.hh (deletePath): Add optional 'linkThreshold' argument.
* nix/libutil/util.cc (_deletePath): Add 'linkThreshold' argument and
honor it.  Pass it down in recursive call.
(deletePath): Add 'linkThreshold' and honor it.
* nix/libstore/gc.cc (LocalStore::deleteGarbage): Pass 'linkThreshold'
argument to 'deletePath', with a value of 2 when PATH is a store item
and deduplication is on.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2017-08-18 11:31:28 +0200'>2017-08-18</span></td><td><a href='/guix/commit/nix/libutil/util.hh?id=ed464f48efd80e6439441d7a9f6d0e7988fb1272'>nix: Remove unused function.</a><span class='msg-avail'>...<span class='msg-tooltip'>* nix/libutil/util.hh:
* nix/libutil/util.cc (decodeOctalEscaped): Remove unused and buggy function.
</span></span></td><td>Andy Wingo</td></tr>