head 1.2; access; symbols pkgsrc-2026Q2:1.1.0.12 pkgsrc-2026Q2-base:1.1 pkgsrc-2026Q1:1.1.0.10 pkgsrc-2026Q1-base:1.1 pkgsrc-2025Q4:1.1.0.8 pkgsrc-2025Q4-base:1.1 pkgsrc-2025Q3:1.1.0.6 pkgsrc-2025Q3-base:1.1 pkgsrc-2025Q2:1.1.0.4 pkgsrc-2025Q2-base:1.1 pkgsrc-2025Q1:1.1.0.2; locks; strict; comment @ * @; 1.2 date 2026.08.30.08.51.27; author ryoon; state dead; branches; next 1.1; commitid oPiP8T31qUKeJDTG; 1.1 date 2025.05.12.16.03.20; author wiz; state Exp; branches 1.1.2.1; next ; commitid tq4oVgRhCy6VnDUF; 1.1.2.1 date 2025.05.12.16.03.20; author maya; state dead; branches; next 1.1.2.2; commitid jwAIyOFXRVTOE8VF; 1.1.2.2 date 2025.05.16.14.14.44; author maya; state Exp; branches; next ; commitid jwAIyOFXRVTOE8VF; desc @@ 1.2 log @misc/screen: Update to 5.0.2 Changelog: Version 5.0.2 (12/07/26): * Add %* escape to output caret character literal ("^") * Add portable PAM conversation callback prototype (for Solaris) * Fixes: - type in screen on big-endian systems - UTF-8 combining sequences - typos - buffer overflow in SendCmdMessage() - detaching fail with empty terminfo and leave the session attached - eliminates the TOCTOU race - manpage fixes Version 5.0.1 (12/05/25): * Fixes: - CVE-2025-46805: do NOT send signals with root privileges - CVE-2025-46804: avoid file existence test information leaks - CVE-2025-46803: apply safe PTY default mode of 0620 - CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher - CVE-2025-23395: reintroduce lf_secreopen() for logfile - buffer overflow due bad strncpy() - uninitialized variables warnings - typos - combining char handling that could lead to a segfault @ text @$NetBSD: patch-attacher.c,v 1.1 2025/05/12 16:03:20 wiz Exp $ https://security.opensuse.org/2025/05/12/screen-security-issues.html --- attacher.c.orig 2024-08-28 19:55:03.000000000 +0000 +++ attacher.c @@@@ -127,9 +127,6 @@@@ int Attach(int how) xseteuid(multi_uid); xseteuid(own_uid); #endif - if (chmod(attach_tty, 0666)) - Panic(errno, "chmod %s", attach_tty); - tty_oldmode = tty_mode; } memset((char *)&m, 0, sizeof(Message)); @@@@ -279,12 +276,6 @@@@ int Attach(int how) pause(); /* wait for SIGCONT */ xsignal(SIGCONT, SIG_DFL); ContinuePlease = false; - xseteuid(own_uid); - if (tty_oldmode >= 0) - if (chmod(attach_tty, tty_oldmode)) - Panic(errno, "chmod %s", attach_tty); - tty_oldmode = -1; - xseteuid(real_uid); } rflag = 0; return 1; @@@@ -334,11 +325,6 @@@@ void AttacherFinit(int sigsig) close(s); } } - if (tty_oldmode >= 0) { - if (setuid(own_uid)) - Panic(errno, "setuid"); - chmod(attach_tty, tty_oldmode); - } exit(0); } @@@@ -457,13 +443,16 @@@@ void SendCmdMessage(char *sty, char *mat } p = m.m.command.cmd; n = 0; + size_t space_left = ARRAY_SIZE(m.m.command.cmd); + for (; *av && n < MAXARGS - 1; ++av, ++n) { - size_t len; - len = strlen(*av) + 1; - if (p + len >= m.m.command.cmd + ARRAY_SIZE(m.m.command.cmd) - 1) - break; - strncpy(p, *av, MAXPATHLEN); - p += len; + int printed = snprintf(p, space_left, "%s", *av); + if (printed < 0 || (size_t)printed >= space_left) + Panic(0, "Total length of the command to send too large.\n"); + + printed += 1; // add null terminator + p += printed; + space_left -= printed; } *p = 0; m.m.command.nargs = n; @ 1.1 log @screen: add opensuse patches for security problems For https://security.opensuse.org/2025/05/12/screen-security-issues.html Bump PKGREVISION. @ text @d1 1 a1 1 $NetBSD$ @ 1.1.2.1 log @file patch-attacher.c was added on branch pkgsrc-2025Q1 on 2025-05-16 14:14:44 +0000 @ text @d1 64 @ 1.1.2.2 log @Pullup ticket #6964 - requested by bsiegert misc/screen: Security fix (PR pkg/59417) Revisions pulled up: - misc/screen/MESSAGE deleted - misc/screen/Makefile 1.128-1.129 - misc/screen/distinfo 1.67 - misc/screen/patches/patch-attacher.c 1.1 - misc/screen/patches/patch-configure 1.1 - misc/screen/patches/patch-configure.ac 1.1 - misc/screen/patches/patch-logfile.c 1.1 - misc/screen/patches/patch-logfile.h 1.1 - misc/screen/patches/patch-process.c 1.1 - misc/screen/patches/patch-screen.c 1.7 - misc/screen/patches/patch-screen.h 1.1 - misc/screen/patches/patch-socket.c 1.7 --- Module Name: pkgsrc Committed By: wiz Date: Mon May 12 15:46:06 UTC 2025 Modified Files: pkgsrc/misc/screen: Makefile Removed Files: pkgsrc/misc/screen: MESSAGE Log Message: screen: remove setuid bit because of security problems Remove MESSAGE while here. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: wiz Date: Mon May 12 16:03:20 UTC 2025 Modified Files: pkgsrc/misc/screen: Makefile distinfo pkgsrc/misc/screen/patches: patch-socket.c Added Files: pkgsrc/misc/screen/patches: patch-attacher.c patch-configure patch-configure.ac patch-logfile.c patch-logfile.h patch-process.c patch-screen.c patch-screen.h Log Message: screen: add opensuse patches for security problems For https://security.opensuse.org/2025/05/12/screen-security-issues.html Bump PKGREVISION. @ text @a0 64 $NetBSD: patch-attacher.c,v 1.1 2025/05/12 16:03:20 wiz Exp $ https://security.opensuse.org/2025/05/12/screen-security-issues.html --- attacher.c.orig 2024-08-28 19:55:03.000000000 +0000 +++ attacher.c @@@@ -127,9 +127,6 @@@@ int Attach(int how) xseteuid(multi_uid); xseteuid(own_uid); #endif - if (chmod(attach_tty, 0666)) - Panic(errno, "chmod %s", attach_tty); - tty_oldmode = tty_mode; } memset((char *)&m, 0, sizeof(Message)); @@@@ -279,12 +276,6 @@@@ int Attach(int how) pause(); /* wait for SIGCONT */ xsignal(SIGCONT, SIG_DFL); ContinuePlease = false; - xseteuid(own_uid); - if (tty_oldmode >= 0) - if (chmod(attach_tty, tty_oldmode)) - Panic(errno, "chmod %s", attach_tty); - tty_oldmode = -1; - xseteuid(real_uid); } rflag = 0; return 1; @@@@ -334,11 +325,6 @@@@ void AttacherFinit(int sigsig) close(s); } } - if (tty_oldmode >= 0) { - if (setuid(own_uid)) - Panic(errno, "setuid"); - chmod(attach_tty, tty_oldmode); - } exit(0); } @@@@ -457,13 +443,16 @@@@ void SendCmdMessage(char *sty, char *mat } p = m.m.command.cmd; n = 0; + size_t space_left = ARRAY_SIZE(m.m.command.cmd); + for (; *av && n < MAXARGS - 1; ++av, ++n) { - size_t len; - len = strlen(*av) + 1; - if (p + len >= m.m.command.cmd + ARRAY_SIZE(m.m.command.cmd) - 1) - break; - strncpy(p, *av, MAXPATHLEN); - p += len; + int printed = snprintf(p, space_left, "%s", *av); + if (printed < 0 || (size_t)printed >= space_left) + Panic(0, "Total length of the command to send too large.\n"); + + printed += 1; // add null terminator + p += printed; + space_left -= printed; } *p = 0; m.m.command.nargs = n; @