head 1.2; access; symbols pkgsrc-2026Q2:1.1.0.12 pkgsrc-2026Q2-base:1.1 pkgsrc-2026Q1:1.1.0.10 pkgsrc-2026Q1-base:1.1 pkgsrc-2025Q4:1.1.0.8 pkgsrc-2025Q4-base:1.1 pkgsrc-2025Q3:1.1.0.6 pkgsrc-2025Q3-base:1.1 pkgsrc-2025Q2:1.1.0.4 pkgsrc-2025Q2-base:1.1 pkgsrc-2025Q1:1.1.0.2; locks; strict; comment @ * @; 1.2 date 2026.08.30.08.51.27; author ryoon; state dead; branches; next 1.1; commitid oPiP8T31qUKeJDTG; 1.1 date 2025.05.12.16.03.20; author wiz; state Exp; branches 1.1.2.1; next ; commitid tq4oVgRhCy6VnDUF; 1.1.2.1 date 2025.05.12.16.03.20; author maya; state dead; branches; next 1.1.2.2; commitid jwAIyOFXRVTOE8VF; 1.1.2.2 date 2025.05.16.14.14.45; author maya; state Exp; branches; next ; commitid jwAIyOFXRVTOE8VF; desc @@ 1.2 log @misc/screen: Update to 5.0.2 Changelog: Version 5.0.2 (12/07/26): * Add %* escape to output caret character literal ("^") * Add portable PAM conversation callback prototype (for Solaris) * Fixes: - type in screen on big-endian systems - UTF-8 combining sequences - typos - buffer overflow in SendCmdMessage() - detaching fail with empty terminfo and leave the session attached - eliminates the TOCTOU race - manpage fixes Version 5.0.1 (12/05/25): * Fixes: - CVE-2025-46805: do NOT send signals with root privileges - CVE-2025-46804: avoid file existence test information leaks - CVE-2025-46803: apply safe PTY default mode of 0620 - CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher - CVE-2025-23395: reintroduce lf_secreopen() for logfile - buffer overflow due bad strncpy() - uninitialized variables warnings - typos - combining char handling that could lead to a segfault @ text @$NetBSD: patch-logfile.c,v 1.1 2025/05/12 16:03:20 wiz Exp $ https://security.opensuse.org/2025/05/12/screen-security-issues.html --- logfile.c.orig 2024-08-28 19:55:03.000000000 +0000 +++ logfile.c @@@@ -88,10 +88,29 @@@@ static int logfile_reopen(char *name, in return -1; } changed_logfile(l); - l->st->st_ino = l->st->st_dev = 0; return 0; } +static int (*lf_reopen_fn) (char *, int, struct Log *) = logfile_reopen; + +/* + * Whenever logfwrite discoveres that it is required to close and + * reopen the logfile, the function registered here is called. + * If you do not register anything here, the above logfile_reopen() + * will be used instead. + * Your function should perform the same steps as logfile_reopen(): + * a) close the original filedescriptor without flushing any output + * b) open a new logfile for future output on the same filedescriptor number. + * c) zero out st_dev, st_ino to tell the stolen_logfile() indcator to + * reinitialise itself. + * d) return 0 on success. + */ +void logreopen_register(int (*fn) (char *, int, struct Log *)) +{ + lf_reopen_fn = fn ? fn : logfile_reopen; +} + + /* * If the logfile has been removed, truncated, unlinked or the like, * return nonzero. @@@@ -204,7 +223,7 @@@@ int logfwrite(Log *l, char *buf, size_t { int r; - if (stolen_logfile(l) && logfile_reopen(l->name, fileno(l->fp), l)) + if (stolen_logfile(l) && lf_reopen_fn(l->name, fileno(l->fp), l)) return -1; r = fwrite(buf, n, 1, l->fp); l->writecount += l->flushcount + 1; @@@@ -219,13 +238,13 @@@@ int logfflush(Log *l) if (!l) for (l = logroot; l; l = l->next) { - if (stolen_logfile(l) && logfile_reopen(l->name, fileno(l->fp), l)) + if (stolen_logfile(l) && lf_reopen_fn(l->name, fileno(l->fp), l)) return -1; r |= fflush(l->fp); l->flushcount++; changed_logfile(l); } else { - if (stolen_logfile(l) && logfile_reopen(l->name, fileno(l->fp), l)) + if (stolen_logfile(l) && lf_reopen_fn(l->name, fileno(l->fp), l)) return -1; r = fflush(l->fp); l->flushcount++; @ 1.1 log @screen: add opensuse patches for security problems For https://security.opensuse.org/2025/05/12/screen-security-issues.html Bump PKGREVISION. @ text @d1 1 a1 1 $NetBSD$ @ 1.1.2.1 log @file patch-logfile.c was added on branch pkgsrc-2025Q1 on 2025-05-16 14:14:45 +0000 @ text @d1 62 @ 1.1.2.2 log @Pullup ticket #6964 - requested by bsiegert misc/screen: Security fix (PR pkg/59417) Revisions pulled up: - misc/screen/MESSAGE deleted - misc/screen/Makefile 1.128-1.129 - misc/screen/distinfo 1.67 - misc/screen/patches/patch-attacher.c 1.1 - misc/screen/patches/patch-configure 1.1 - misc/screen/patches/patch-configure.ac 1.1 - misc/screen/patches/patch-logfile.c 1.1 - misc/screen/patches/patch-logfile.h 1.1 - misc/screen/patches/patch-process.c 1.1 - misc/screen/patches/patch-screen.c 1.7 - misc/screen/patches/patch-screen.h 1.1 - misc/screen/patches/patch-socket.c 1.7 --- Module Name: pkgsrc Committed By: wiz Date: Mon May 12 15:46:06 UTC 2025 Modified Files: pkgsrc/misc/screen: Makefile Removed Files: pkgsrc/misc/screen: MESSAGE Log Message: screen: remove setuid bit because of security problems Remove MESSAGE while here. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: wiz Date: Mon May 12 16:03:20 UTC 2025 Modified Files: pkgsrc/misc/screen: Makefile distinfo pkgsrc/misc/screen/patches: patch-socket.c Added Files: pkgsrc/misc/screen/patches: patch-attacher.c patch-configure patch-configure.ac patch-logfile.c patch-logfile.h patch-process.c patch-screen.c patch-screen.h Log Message: screen: add opensuse patches for security problems For https://security.opensuse.org/2025/05/12/screen-security-issues.html Bump PKGREVISION. @ text @a0 62 $NetBSD: patch-logfile.c,v 1.1 2025/05/12 16:03:20 wiz Exp $ https://security.opensuse.org/2025/05/12/screen-security-issues.html --- logfile.c.orig 2024-08-28 19:55:03.000000000 +0000 +++ logfile.c @@@@ -88,10 +88,29 @@@@ static int logfile_reopen(char *name, in return -1; } changed_logfile(l); - l->st->st_ino = l->st->st_dev = 0; return 0; } +static int (*lf_reopen_fn) (char *, int, struct Log *) = logfile_reopen; + +/* + * Whenever logfwrite discoveres that it is required to close and + * reopen the logfile, the function registered here is called. + * If you do not register anything here, the above logfile_reopen() + * will be used instead. + * Your function should perform the same steps as logfile_reopen(): + * a) close the original filedescriptor without flushing any output + * b) open a new logfile for future output on the same filedescriptor number. + * c) zero out st_dev, st_ino to tell the stolen_logfile() indcator to + * reinitialise itself. + * d) return 0 on success. + */ +void logreopen_register(int (*fn) (char *, int, struct Log *)) +{ + lf_reopen_fn = fn ? fn : logfile_reopen; +} + + /* * If the logfile has been removed, truncated, unlinked or the like, * return nonzero. @@@@ -204,7 +223,7 @@@@ int logfwrite(Log *l, char *buf, size_t { int r; - if (stolen_logfile(l) && logfile_reopen(l->name, fileno(l->fp), l)) + if (stolen_logfile(l) && lf_reopen_fn(l->name, fileno(l->fp), l)) return -1; r = fwrite(buf, n, 1, l->fp); l->writecount += l->flushcount + 1; @@@@ -219,13 +238,13 @@@@ int logfflush(Log *l) if (!l) for (l = logroot; l; l = l->next) { - if (stolen_logfile(l) && logfile_reopen(l->name, fileno(l->fp), l)) + if (stolen_logfile(l) && lf_reopen_fn(l->name, fileno(l->fp), l)) return -1; r |= fflush(l->fp); l->flushcount++; changed_logfile(l); } else { - if (stolen_logfile(l) && logfile_reopen(l->name, fileno(l->fp), l)) + if (stolen_logfile(l) && lf_reopen_fn(l->name, fileno(l->fp), l)) return -1; r = fflush(l->fp); l->flushcount++; @