[OE-core] [sumo] [PATCH v1 1/2] ncurses: CVE-2018-10754

[Sinan Kaya]

* CVE-2018-10754
A NULL pointer dereference was found in the way the _nc_parse_entry
function parses terminfo data for compilation. An attacker able to provide
specially crafted terminfo data could use this flaw to crash the
application parsing it.

Affects < 6.1.20180414

CVE: CVE-2018-10754
Ref: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10754
Signed-off-by: Sinan Kaya <okaya at kernel.org>
---
 .../ncurses/files/CVE-2018-10754.patch        | 34 +++++++++++++++++++
 .../ncurses/ncurses_6.0+20171125.bb           |  1 +
 2 files changed, 35 insertions(+)
 create mode 100644 meta/recipes-core/ncurses/files/CVE-2018-10754.patch

diff --git a/meta/recipes-core/ncurses/files/CVE-2018-10754.patch b/meta/recipes-core/ncurses/files/CVE-2018-10754.patch
new file mode 100644
index 0000000000..e9ba857ed2
--- /dev/null
+++ b/meta/recipes-core/ncurses/files/CVE-2018-10754.patch
@@ -0,0 +1,34 @@
+From 7c012e7a809634839e39d67271b5df3fdf5a37a3 Mon Sep 17 00:00:00 2001
+From: Sinan Kaya <okaya at kernel.org>
+Date: Fri, 5 Oct 2018 01:27:27 +0000
+Subject: [PATCH] ncurses: NULL Pointer Dereference in _nc_parse_entry function
+ in tinfo/parse_entry.c
+
+CVE: CVE-2018-10754
+Upstream-Status: Backport [https://bugzilla.redhat.com/show_bug.cgi?id=1576119]
+Signed-off-by: Sinan Kaya <okaya at kernel.org>
+---
+ ncurses/tinfo/parse_entry.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/ncurses/tinfo/parse_entry.c b/ncurses/tinfo/parse_entry.c
+index bbbfcb27..43d28bdc 100644
+--- a/ncurses/tinfo/parse_entry.c
++++ b/ncurses/tinfo/parse_entry.c
+@@ -543,9 +543,11 @@ _nc_parse_entry(ENTRY * entryp, int literal, bool silent)
+ 		 * Otherwise, look for a base entry that will already
+ 		 * have picked up defaults via translation.
+ 		 */
+-		for (i = 0; i < entryp->nuses; i++)
+-		    if (!strchr((char *) entryp->uses[i].name, '+'))
++		for (i = 0; i < entryp->nuses; i++) {
++		     if (entryp->uses[i].name != 0
++		     && !strchr(entryp->uses[i].name, '+'))
+ 			has_base_entry = TRUE;
++		}
+ 	    }
+ 
+ 	    postprocess_termcap(&entryp->tterm, has_base_entry);
+-- 
+2.19.0
+
diff --git a/meta/recipes-core/ncurses/ncurses_6.0+20171125.bb b/meta/recipes-core/ncurses/ncurses_6.0+20171125.bb
index 6c4b96f428..e2d128897a 100644
--- a/meta/recipes-core/ncurses/ncurses_6.0+20171125.bb
+++ b/meta/recipes-core/ncurses/ncurses_6.0+20171125.bb
@@ -3,6 +3,7 @@ require ncurses.inc
 SRC_URI += "file://0001-tic-hang.patch \
             file://0002-configure-reproducible.patch \
             file://config.cache \
+            file://CVE-2018-10754.patch \
 "
 # commit id corresponds to the revision in package version
 SRCREV = "5d849e836052459901cfe0b85a0b2939ff8d2b2a"
-- 
2.19.0