CVS commit: pkgsrc/devel/ncurses

["Kimmo Suominen" <kim%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   kim
Date:           Sun Jun 22 11:13:07 UTC 2025

Modified Files:
        pkgsrc/devel/ncurses: Makefile distinfo
Added Files:
        pkgsrc/devel/ncurses/patches: patch-ncurses_tinfo_parse_entry.c

Log Message:
ncurses: Cherry picked fix for CVE-2025-6141


To generate a diff of this commit:
cvs rdiff -u -r1.118 -r1.119 pkgsrc/devel/ncurses/Makefile
cvs rdiff -u -r1.53 -r1.54 pkgsrc/devel/ncurses/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_parse_entry.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/ncurses/Makefile
diff -u pkgsrc/devel/ncurses/Makefile:1.118 pkgsrc/devel/ncurses/Makefile:1.119
--- pkgsrc/devel/ncurses/Makefile:1.118 Tue Apr  8 16:43:09 2025
+++ pkgsrc/devel/ncurses/Makefile       Sun Jun 22 11:13:07 2025
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.118 2025/04/08 16:43:09 nia Exp $
+# $NetBSD: Makefile,v 1.119 2025/06/22 11:13:07 kim Exp $
 
 DISTNAME=      ncurses-6.5
+PKGREVISION=   1
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GNU:=ncurses/}
 

Index: pkgsrc/devel/ncurses/distinfo
diff -u pkgsrc/devel/ncurses/distinfo:1.53 pkgsrc/devel/ncurses/distinfo:1.54
--- pkgsrc/devel/ncurses/distinfo:1.53  Mon May  6 08:24:05 2024
+++ pkgsrc/devel/ncurses/distinfo       Sun Jun 22 11:13:07 2025
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.53 2024/05/06 08:24:05 jperkin Exp $
+$NetBSD: distinfo,v 1.54 2025/06/22 11:13:07 kim Exp $
 
 BLAKE2s (ncurses-6.5.tar.gz) = 3de912518d0c9a3cb61cca69d2018bfb28b8b2dbb1a3d68cae70fccaf42da751
 SHA512 (ncurses-6.5.tar.gz) = fc5a13409d2a530a1325776dcce3a99127ddc2c03999cfeb0065d0eee2d68456274fb1c7b3cc99c1937bc657d0e7fca97016e147f93c7821b5a4a6837db821e8
@@ -6,3 +6,4 @@ Size (ncurses-6.5.tar.gz) = 3688489 byte
 SHA1 (patch-misc_run__tic.in) = a6a8dd89da1a2fbbc5fcabfa6d41ce3a41b75722
 SHA1 (patch-ncurses_base_lib_initscr.c) = 3f47c8ce9b98a82aa8db6b6da55810727559d30c
 SHA1 (patch-ncurses_tinfo_lib_raw.c) = 1adea51819538433b681c209f9754a18d0e37ebb
+SHA1 (patch-ncurses_tinfo_parse_entry.c) = ef0f6be1a1b1cdd39b04cf899558e0fcd9578dc3

Added files:

Index: pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_parse_entry.c
diff -u /dev/null pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_parse_entry.c:1.1
--- /dev/null   Sun Jun 22 11:13:07 2025
+++ pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_parse_entry.c      Sun Jun 22 11:13:07 2025
@@ -0,0 +1,16 @@
+$NetBSD: patch-ncurses_tinfo_parse_entry.c,v 1.1 2025/06/22 11:13:07 kim Exp $
+
+Cherry picked fix for CVE-2025-6141 from
+https://invisible-island.net/archives/ncurses/6.5/ncurses-6.5-20250329.patch.gz
+
+--- ncurses/tinfo/parse_entry.c.orig   2023-04-24 22:32:33.000000000 +0000
++++ ncurses/tinfo/parse_entry.c        2025-06-22 07:14:15.542701527 +0000
+@@ -985,6 +985,8 @@
+           bp = tp->Strings[from_ptr->nte_index];
+           if (VALID_STRING(bp)) {
+               for (dp = buf2; *bp; bp++) {
++                  if ((size_t) (dp - buf2) >= (sizeof(buf2) - sizeof(TERMTYPE2)))
++                        break;
+                   if (bp[0] == '$' && bp[1] == '<') {
+                       while (*bp && *bp != '>') {
+                           ++bp;