kumquat-buildroot/package/less/0001-End-OSC8-hyperlink-on-invalid-embedded-escape-sequence.patch
Fabrice Fontaine 924ca9414f package/less: fix CVE-2022-46663
In GNU Less before 609, crafted data can result in "less -R" not
filtering ANSI escape sequences sent to the terminal.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-20 18:05:06 +01:00

28 lines
874 B
Diff

From a78e1351113cef564d790a730d657a321624d79c Mon Sep 17 00:00:00 2001
From: Mark Nudelman <markn@greenwoodsoftware.com>
Date: Fri, 7 Oct 2022 19:25:46 -0700
Subject: [PATCH] End OSC8 hyperlink on invalid embedded escape sequence.
[Retrieved from:
https://github.com/gwsw/less/commit/a78e1351113cef564d790a730d657a321624d79c]
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
line.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/line.c b/line.c
index 236c49ae..cba7bdd1 100644
--- a/line.c
+++ b/line.c
@@ -633,8 +633,8 @@ ansi_step(pansi, ch)
/* Hyperlink ends with \7 or ESC-backslash. */
if (ch == '\7')
return ANSI_END;
- if (pansi->prev_esc && ch == '\\')
- return ANSI_END;
+ if (pansi->prev_esc)
+ return (ch == '\\') ? ANSI_END : ANSI_ERR;
pansi->prev_esc = (ch == ESC);
return ANSI_MID;
}