Skip to content

Commit 9d8cb0c

Browse files
[AUTO-CHERRYPICK] vte291: patch CVE-2024-37535 - branch main (#9484)
Co-authored-by: Neha Agarwal <58672330+neha170@users.noreply.github.com>
1 parent 4c110ec commit 9d8cb0c

2 files changed

Lines changed: 85 additions & 3 deletions

File tree

SPECS/vte291/CVE-2024-37535.patch

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
From c313849c2e5133802e21b13fa0b141b360171d39 Mon Sep 17 00:00:00 2001
2+
From: Christian Persch <chpe@src.gnome.org>
3+
Date: Sun, 2 Jun 2024 19:19:35 +0200
4+
Subject: [PATCH] widget: Add safety limit to widget size requests
5+
6+
https://gitlab.gnome.org/GNOME/vte/-/issues/2786
7+
(cherry picked from commit 1803ba866053a3d7840892b9d31fe2944a183eda)
8+
---
9+
src/vtegtk.cc | 35 +++++++++++++++++++++++++++++++++++
10+
1 file changed, 35 insertions(+)
11+
12+
diff --git a/src/vtegtk.cc b/src/vtegtk.cc
13+
index 24bdd7184..48cae79c1 100644
14+
--- a/src/vtegtk.cc
15+
+++ b/src/vtegtk.cc
16+
@@ -91,6 +91,38 @@
17+
template<typename T>
18+
constexpr bool check_enum_value(T value) noexcept;
19+
20+
+static inline void
21+
+sanitise_widget_size_request(int* minimum,
22+
+ int* natural) noexcept
23+
+{
24+
+ // Overly large size requests will make gtk happily allocate
25+
+ // a window size over the window system's limits (see
26+
+ // e.g. https://gitlab.gnome.org/GNOME/vte/-/issues/2786),
27+
+ // leading to aborting the whole process.
28+
+ // The toolkit should be in a better position to know about
29+
+ // these limits and not exceed them (which here is certainly
30+
+ // possible since our minimum sizes are very small), let's
31+
+ // limit the widget's size request to some large value
32+
+ // that hopefully is within the absolute limits of
33+
+ // the window system (assumed here to be int16 range,
34+
+ // and leaving some space for the widgets that contain
35+
+ // the terminal).
36+
+ auto const limit = (1 << 15) - (1 << 12);
37+
+
38+
+ if (*minimum > limit || *natural > limit) {
39+
+ static auto warned = false;
40+
+
41+
+ if (!warned) {
42+
+ g_warning("Widget size request (minimum %d, natural %d) exceeds limits\n",
43+
+ *minimum, *natural);
44+
+ warned = true;
45+
+ }
46+
+ }
47+
+
48+
+ *minimum = std::min(*minimum, limit);
49+
+ *natural = std::clamp(*natural, *minimum, limit);
50+
+}
51+
+
52+
struct _VteTerminalClassPrivate {
53+
GtkStyleProvider *style_provider;
54+
};
55+
@@ -510,6 +542,7 @@ try
56+
{
57+
VteTerminal *terminal = VTE_TERMINAL(widget);
58+
WIDGET(terminal)->get_preferred_width(minimum_width, natural_width);
59+
+ sanitise_widget_size_request(minimum_width, natural_width);
60+
}
61+
catch (...)
62+
{
63+
@@ -524,6 +557,7 @@ try
64+
{
65+
VteTerminal *terminal = VTE_TERMINAL(widget);
66+
WIDGET(terminal)->get_preferred_height(minimum_height, natural_height);
67+
+ sanitise_widget_size_request(minimum_height, natural_height);
68+
}
69+
catch (...)
70+
{
71+
@@ -781,6 +815,7 @@ try
72+
WIDGET(terminal)->measure(orientation, for_size,
73+
minimum, natural,
74+
minimum_baseline, natural_baseline);
75+
+ sanitise_widget_size_request(minimum, natural);
76+
}
77+
catch (...)
78+
{
79+
--

SPECS/vte291/vte291.spec

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
Summary: Terminal emulator library
1212
Name: vte291
1313
Version: 0.66.2
14-
Release: 2%{?dist}
14+
Release: 3%{?dist}
1515
License: CC-BY AND GPLv2+ AND LGPLv2+
1616
Vendor: Microsoft Corporation
1717
Distribution: Mariner
@@ -21,6 +21,7 @@ Source0: https://download.gnome.org/sources/vte/%{majorver}/vte-%{version
2121
# https://bugzilla.redhat.com/show_bug.cgi?id=1103380
2222
# https://gitlab.gnome.org/GNOME/vte/-/issues/226
2323
Patch100: vte291-cntnr-precmd-preexec-scroll.patch
24+
Patch101: CVE-2024-37535.patch
2425
BuildRequires: gcc-c++
2526
BuildRequires: gettext
2627
BuildRequires: gobject-introspection-devel
@@ -75,8 +76,7 @@ The vte-profile package contains a profile.d script for the VTE terminal
7576
emulator library.
7677

7778
%prep
78-
%setup -q -n vte-%{version}
79-
%patch100 -p1 -b .cntnr-precmd-preexec-scroll
79+
%autosetup -p1 -n vte-%{version}
8080
%if 0%{?flatpak}
8181
# Install user units where systemd macros expect them
8282
sed -i -e "/^vte_systemduserunitdir =/s|vte_prefix|'/usr'|" meson.build
@@ -119,6 +119,9 @@ sed -i -e "/^vte_systemduserunitdir =/s|vte_prefix|'/usr'|" meson.build
119119
%{_sysconfdir}/profile.d/vte.sh
120120

121121
%changelog
122+
* Thu Jun 13 2024 Neha Agarwal <nehaagarwal@microsoft.com> - 0.66.2-3
123+
- Patch CVE-2024-37535
124+
122125
* Wed Sep 20 2023 Jon Slobodzian <joslobo@microsoft.com> - 0.66.2-2
123126
- Recompile with stack-protection fixed gcc version (CVE-2023-4039)
124127

0 commit comments

Comments
 (0)