CVE-2021-27135: Insufficient Information (NVD-CWE-noinfo)
value: xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-02-10T16:15Z
Repository: https://github.com/ThomasDickey/xterm-snapshots
Language: Other
Files changed: MANIFEST, button.c, xterm.log.html
Commit date: 2021-02-10 20:05:07 +0000
Commit message: snapshot of project "xterm", label xterm-365d

Diff: diff --git a/MANIFEST b/MANIFEST
index 47e1318..3ed1c73 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -1,6 +1,6 @@
-MANIFEST for xterm, version xterm-365c
+MANIFEST for xterm, version xterm-365d
 --------------------------------------------------------------------------------
 MANIFEST                        this file
 256colres.h                     resource-definitions for 256-color mode
 256colres.pl                    script to generate 256colres.h
 88colres.h                      resource definitions for 88-color mode
diff --git a/button.c b/button.c
index fba8556..37c513b 100644
--- a/button.c
+++ b/button.c
@@ -1,6 +1,6 @@
-/* $XTermId: button.c,v 1.631 2021/02/04 01:00:26 tom Exp $ */
+/* $XTermId: button.c,v 1.634 2021/02/09 23:04:41 tom Exp $ */
 
 /*
  * Copyright 1999-2020,2021 by Thomas E. Dickey
  *
  *                         All Rights Reserved
@@ -4321,10 +4321,11 @@ SaltTextAway(XtermWidget xw,
     TScreen *screen = TScreenOf(xw);
     SelectedCells *scp;
     int i;
     int eol;
     int need = 0;
+    size_t have = 0;
     Char *line;
     Char *lp;
     CELL first = *cellc;
     CELL last = *cell;
 
@@ -4355,11 +4356,15 @@ SaltTextAway(XtermWidget xw,
 	    need += Length(screen, last.row, 0, last.col);
     }
 
     /* UTF-8 may require more space */
     if_OPT_WIDE_CHARS(screen, {
-	need *= 4;
+	if (need > 0) {
+	    if (screen->max_combining > 0)
+		need += screen->max_combining;
+	    need *= 6;
+	}
     });
 
     /* now get some memory to save it in */
     if (need < 0)
 	return;
@@ -4393,14 +4398,24 @@ SaltTextAway(XtermWidget xw,
 	if (last.col >= 0)
 	    lp = SaveText(screen, last.row, 0, last.col, lp, &eol);
     }
     *lp = '\0';			/* make sure we have end marked */
 
-    TRACE(("Salted TEXT:%u:%s\n", (unsigned) (lp - line),
-	   visibleChars(line, (unsigned) (lp - line))));
+    have = (size_t) (lp - line);
+    /*
+     * Scanning the buffer twice is unnecessary.  Discard unwanted memory if
+     * the estimate is too-far off.
+     */
+    if ((have * 2) < (size_t) need) {
+	scp->data_limit = have + 1;
+	line = realloc(line, scp->data_limit);
+    }
+
+    TRACE(("Salted TEXT:%u:%s\n", (unsigned) have,
+	   visibleChars(line, (unsigned) have)));
 
-    scp->data_length = (size_t) (lp - line);
+    scp->data_length = have;
 }
 
 #if OPT_PASTE64
 void
 ClearSelectionBuffer(TScreen *screen, String selection)
diff --git a/xterm.log.html b/xterm.log.html
index 5e637b2..fd186a2 100644
--- a/xterm.log.html
+++ b/xterm.log.html
@@ -28,11 +28,11 @@
  * Except as contained in this notice, the name(s) of the above copyright    *
  * holders shall not be used in advertising or otherwise to promote the      *
  * sale, use or other dealings in this Software without prior written        *
  * authorization.                                                            *
  *****************************************************************************
-  $XTermId: xterm.log.html,v 1.2309 2021/02/09 01:30:44 tom Exp $
+  $XTermId: xterm.log.html,v 1.2311 2021/02/09 21:59:33 tom Exp $
   -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN">
 <html>
 <head>
   <meta name="generator" content=
@@ -1011,10 +1011,13 @@
   </ul>
 
   <h1><a name="xterm_dev" id="xterm_dev">Development</a></h1>
 
   <ul>
+    <li>correct upper-limit for selection buffer, accounting for
+    combining characters (report by Tavis Ormandy).</li>
+
     <li>with <code>alwaysHighlight</code> true, xterm does not
     properly track focus. The <em>screen-&gt;select</em>
     <code>FOCUS</code> flag remains always on, which prevents
     <code>bellIsUrgent</code> from working, as the urgent
     <code>WM_HINT</code> flag is only set in

Vulnerable code: MANIFEST for xterm, version xterm-365c
/* $XTermId: button.c,v 1.631 2021/02/04 01:00:26 tom Exp $ */
	need *= 4;
    TRACE(("Salted TEXT:%u:%s\n", (unsigned) (lp - line),
	   visibleChars(line, (unsigned) (lp - line))));
    scp->data_length = (size_t) (lp - line);
  $XTermId: xterm.log.html,v 1.2309 2021/02/09 01:30:44 tom Exp $
Fixed code: MANIFEST for xterm, version xterm-365d
/* $XTermId: button.c,v 1.634 2021/02/09 23:04:41 tom Exp $ */
    size_t have = 0;
	if (need > 0) {
	    if (screen->max_combining > 0)
		need += screen->max_combining;
	    need *= 6;
	}
    have = (size_t) (lp - line);
    /*
     * Scanning the buffer twice is unnecessary.  Discard unwanted memory if
     * the estimate is too-far off.
     */
    if ((have * 2) < (size_t) need) {
	scp->data_limit = have + 1;
	line = realloc(line, scp->data_limit);
    }

    TRACE(("Salted TEXT:%u:%s\n", (unsigned) have,
	   visibleChars(line, (unsigned) have)));
    scp->data_length = have;
  $XTermId: xterm.log.html,v 1.2311 2021/02/09 21:59:33 tom Exp $
    <li>correct upper-limit for selection buffer, accounting for
    combining characters (report by Tavis Ormandy).</li>