Your message dated Sat, 20 Mar 2021 21:24:26 +0530 with message-id <CAPP0f94boM55htNN2S7L9=vp4l-teyow4mj0wxruq2xj4be...@mail.gmail.com> and subject line Re: Bug#984615: xterm: bug in CVE-2021-27135 patch in at least stretch has caused the Debian Bug report #984615, regarding xterm: bug in CVE-2021-27135 patch in at least stretch to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 984615: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=984615 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Source: xterm Version: 327-2+deb9u1 Severity: serious Justification: introduces use-after-realloc debian/patches/CVE-2021-27135.patch changes button.c line (after patching) 3747 to: line = realloc(line, screen->selection_size); But “line” is a local variable, the address of the buffer must be stored in the one handed out, too, so please change this to: if ((have * 2) < (size_t) j) { Char *next = realloc(line, have + 1); if (next) { screen->selection_data = line = next; screen->selection_size = have + 1; } } This also deals properly with realloc failures (since we’re shrinking, ignore them and just keep the older, larger area). I’ve not looked at jessie-ELTS or buster-security whether they are affected as well; sid is clean (and where I got the realloc failure check necessity from, although sid’s free()s the buffer if realloc fails; this isn’t needed @Tom). bye, //mirabilos -- <ch> you introduced a merge commit │<mika> % g rebase -i HEAD^^ <mika> sorry, no idea and rebasing just fscked │<mika> Segmentation <ch> should have cloned into a clean repo │ fault (core dumped) <ch> if I rebase that now, it's really ugh │<mika:#grml> wuahhhhhh
--- End Message ---
--- Begin Message ---Hello, Thanks to Thomas for his help, I've uploaded a fix for this regression (by reverting the backport of that part of the patch which was not necessary for this CVE fix). And thanks to Thorsten for his comprehensive bug report and to Sven for further debugging and taking a look. Thorsten, could you please test the latest upload and see if everything works alright for you? Please note that I haven't yet announced the update. I'll do so after I get confirmation on the above thingy^. - u
--- End Message ---
