CVE-2021-27135 (published 2021-02-10T16:15Z)

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/ThomasDickey/xterm-snapshots
commit_details: repo_url: https://github.com/ThomasDickey/xterm-snapshots
author: Thomas E. Dickey
author_date: 2021-02-09 23:04:41+00:00
msg: snapshot of project "xterm", label xterm-365d
repository: repo_url: https://github.com/ThomasDickey/xterm-snapshots
repo_name: ThomasDickey/xterm-snapshots
description: snapshots of releases and interim labels for "xterm" https://invisible-island.net/personal/git-exports.html (no pull requests)
repo_language: C
owner: ThomasDickey
file_changes: filename: MANIFEST
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-MANIFEST for xterm, version xterm-365c
+MANIFEST for xterm, version xterm-365d
 --------------------------------------------------------------------------------
 MANIFEST                        this file
 256colres.h                     resource-definitions for 256-color mode

programming_language: Markdown
filename: button.c
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/* $XTermId: button.c,v 1.631 2021/02/04 01:00:26 tom Exp $ */
+/* $XTermId: button.c,v 1.634 2021/02/09 23:04:41 tom Exp $ */
 
 /*
  * Copyright 1999-2020,2021 by Thomas E. Dickey
@@ -4323,6 +4323,7 @@ SaltTextAway(XtermWidget xw,
     int i;
     int eol;
     int need = 0;
+    size_t have = 0;
     Char *line;
     Char *lp;
     CELL first = *cellc;
@@ -4357,7 +4358,11 @@ SaltTextAway(XtermWidget xw,
 
     /* UTF-8 may require more space */
     if_OPT_WIDE_CHARS(screen, {
-	need *= 4;
+	if (need > 0) {
+	    if (screen->max_combining > 0)
+		need += screen->max_combining;
+	    need *= 6;
+	}
     });
 
     /* now get some memory to save it in */
@@ -4395,10 +4400,20 @@ SaltTextAway(XtermWidget xw,
     }
     *lp = '\0';			/* make sure we have end marked */
 
-    TRACE(("Salted TEXT:%u:%s\n", (unsigned) (lp - line),
-	   visibleChars(line, (unsigned) (lp - line))));
+    have = (size_t) (lp - line);
+    /*
+     * Scanning the buffer twice is unnecessary.  Discard unwanted memory if
+     * the estimate is too-far off.
+     */
+    if ((have * 2) < (size_t) need) {
+	scp->data_limit = have + 1;
+	line = realloc(line, scp->data_limit);
+    }
+
+    TRACE(("Salted TEXT:%u:%s\n", (unsigned) have,
+	   visibleChars(line, (unsigned) have)));
 
-    scp->data_length = (size_t) (lp - line);
+    scp->data_length = have;
 }
 
 #if OPT_PASTE64

programming_language: C
filename: xterm.log.html
change_type: ModificationType.MODIFY
diff: @@ -30,7 +30,7 @@
  * sale, use or other dealings in this Software without prior written        *
  * authorization.                                                            *
  *****************************************************************************
-  $XTermId: xterm.log.html,v 1.2309 2021/02/09 01:30:44 tom Exp $
+  $XTermId: xterm.log.html,v 1.2311 2021/02/09 21:59:33 tom Exp $
   -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN">
 <html>
@@ -1013,6 +1013,9 @@
   <h1><a name="xterm_dev" id="xterm_dev">Development</a></h1>
 
   <ul>
+    <li>correct upper-limit for selection buffer, accounting for
+    combining characters (report by Tavis Ormandy).</li>
+
     <li>with <code>alwaysHighlight</code> true, xterm does not
     properly track focus. The <em>screen-&gt;select</em>
     <code>FOCUS</code> flag remains always on, which prevents

programming_language: HTML