From 6f6db0e8fd14e40096a0ee6f8bdf32dedbd3fc9e Mon Sep 17 00:00:00 2001 From: Hitendra Prajapati Date: Mon, 6 Apr 2026 18:08:09 +0530 Subject: [PATCH] add limit-check in infocmp origin : https://invisible-island.net/archives/ncurses/6.5/ncurses-6.5-20251213.patch.gz Refer: https://github.com/Cao-Wuhui/CVE-2025-69720 patch by : Thomas E. Dickey CVE: CVE-2025-69720 Upstream-Status: Backport [https://github.com/ThomasDickey/ncurses-snapshots/commit/6f6db0e8fd14e40096a0ee6f8bdf32dedbd3fc9e] Signed-off-by: Hitendra Prajapati --- progs/infocmp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/progs/infocmp.c b/progs/infocmp.c index 0ee0b958..538aca5a 100644 --- a/progs/infocmp.c +++ b/progs/infocmp.c @@ -816,7 +816,7 @@ lookup_params(const assoc * table, char *dst, char *src) static void analyze_string(const char *name, const char *cap, TERMTYPE2 *tp) { - char buf2[MAX_TERMINFO_LENGTH]; + char buf2[MAX_TERMINFO_LENGTH + 1]; const char *sp; const assoc *ap; int tp_lines = tp->Numbers[2]; @@ -846,7 +846,8 @@ analyze_string(const char *name, const char *cap, TERMTYPE2 *tp) if (VALID_STRING(cp) && cp[0] != '\0' && cp != cap) { - len = strlen(cp); + if ((len = strlen(cp)) > MAX_TERMINFO_LENGTH) + len = MAX_TERMINFO_LENGTH; _nc_STRNCPY(buf2, sp, len); buf2[len] = '\0'; -- 2.50.1