File fix-cve201819387.patch of Package tmux

Overview Repositories Revisions Requests Users Attributes Meta

File fix-cve201819387.patch of Package tmux (Revision 6847cd2193f0a33500868b210f0db5b9)

Currently displaying revision 6847cd2193f0a33500868b210f0db5b9 , Show latest

From b32e1d34e10a0da806823f57f02a4ae6e93d756e Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Mon, 19 Nov 2018 13:35:40 +0000
Subject: [PATCH] evbuffer_new and bufferevent_new can both fail (when malloc
 fails) and return NULL. GitHub issue 1547.

diff --git a/usr.bin/tmux/cmd-pipe-pane.c b/usr.bin/tmux/cmd-pipe-pane.c
index 7b1ee05addb..95af043211b 100644
--- a/usr.bin/tmux/cmd-pipe-pane.c
+++ b/usr.bin/tmux/cmd-pipe-pane.c
@@ -166,6 +166,8 @@ cmd_pipe_pane_exec(struct cmd *self, struct cmdq_item *item)
 		    cmd_pipe_pane_write_callback,
 		    cmd_pipe_pane_error_callback,
 		    wp);
+		if (wp->pipe_event == NULL)
+			fatalx("out of memory");
 		if (out)
 			bufferevent_enable(wp->pipe_event, EV_WRITE);
 		if (in)
diff --git a/usr.bin/tmux/control-notify.c b/usr.bin/tmux/control-notify.c
index ecd64aca943..5927a5e9322 100644
--- a/usr.bin/tmux/control-notify.c
+++ b/usr.bin/tmux/control-notify.c
@@ -47,6 +47,8 @@ control_notify_input(struct client *c, struct window_pane *wp,
 	 */
 	if (winlink_find_by_window(&c->session->windows, wp->window) != NULL) {
 		message = evbuffer_new();
+		if (message == NULL)
+			fatalx("out of memory");
 		evbuffer_add_printf(message, "%%output %%%u ", wp->id);
 		for (i = 0; i < len; i++) {
 			if (buf[i] < ' ' || buf[i] == '\\')
diff --git a/usr.bin/tmux/format.c b/usr.bin/tmux/format.c
index abd1e0a0fc4..f788de8da14 100644
--- a/usr.bin/tmux/format.c
+++ b/usr.bin/tmux/format.c
@@ -573,6 +573,8 @@ format_cb_pane_tabs(struct format_tree *ft, struct format_entry *fe)
 		return;
 
 	buffer = evbuffer_new();
+	if (buffer == NULL)
+		fatalx("out of memory");
 	for (i = 0; i < wp->base.grid->sx; i++) {
 		if (!bit_test(wp->base.tabs, i))
 			continue;
@@ -603,6 +605,8 @@ format_cb_session_group_list(struct format_tree *ft, struct format_entry *fe)
 		return;
 
 	buffer = evbuffer_new();
+	if (buffer == NULL)
+		fatalx("out of memory");
 	TAILQ_FOREACH(loop, &sg->sessions, gentry) {
 		if (EVBUFFER_LENGTH(buffer) > 0)
 			evbuffer_add(buffer, ",", 1);
diff --git a/usr.bin/tmux/input.c b/usr.bin/tmux/input.c
index e97f6d7c690..df920b34f0a 100644
--- a/usr.bin/tmux/input.c
+++ b/usr.bin/tmux/input.c
@@ -767,6 +767,8 @@ input_init(struct window_pane *wp)
 	ictx->input_buf = xmalloc(INPUT_BUF_START);
 
 	ictx->since_ground = evbuffer_new();
+	if (ictx->since_ground == NULL)
+		fatalx("out of memory");
 
 	evtimer_set(&ictx->timer, input_timer_callback, ictx);
 
diff --git a/usr.bin/tmux/job.c b/usr.bin/tmux/job.c
index edc06e141d3..74878d78c18 100644
--- a/usr.bin/tmux/job.c
+++ b/usr.bin/tmux/job.c
@@ -155,6 +155,8 @@ job_run(const char *cmd, struct session *s, const char *cwd,
 
 	job->event = bufferevent_new(job->fd, job_read_callback,
 	    job_write_callback, job_error_callback, job);
+	if (job->event == NULL)
+		fatalx("out of memory");
 	bufferevent_enable(job->event, EV_READ|EV_WRITE);
 
 	log_debug("run job %p: %s, pid %ld", job, job->cmd, (long) job->pid);
diff --git a/usr.bin/tmux/server-client.c b/usr.bin/tmux/server-client.c
index 27c96891d32..8fa9b332a8c 100644
--- a/usr.bin/tmux/server-client.c
+++ b/usr.bin/tmux/server-client.c
@@ -186,8 +186,14 @@ server_client_create(int fd)
 	TAILQ_INIT(&c->queue);
 
 	c->stdin_data = evbuffer_new();
+	if (c->stdin_data == NULL)
+		fatalx("out of memory");
 	c->stdout_data = evbuffer_new();
+	if (c->stdout_data == NULL)
+		fatalx("out of memory");
 	c->stderr_data = evbuffer_new();
+	if (c->stderr_data == NULL)
+		fatalx("out of memory");
 
 	c->tty.fd = -1;
 	c->title = NULL;
diff --git a/usr.bin/tmux/tty.c b/usr.bin/tmux/tty.c
index e5298c6f368..24761b71471 100644
--- a/usr.bin/tmux/tty.c
+++ b/usr.bin/tmux/tty.c
@@ -258,9 +258,13 @@ tty_open(struct tty *tty, char **cause)
 	event_set(&tty->event_in, tty->fd, EV_PERSIST|EV_READ,
 	    tty_read_callback, tty);
 	tty->in = evbuffer_new();
+	if (tty->in == NULL)
+		fatal("out of memory");
 
 	event_set(&tty->event_out, tty->fd, EV_WRITE, tty_write_callback, tty);
 	tty->out = evbuffer_new();
+	if (tty->out == NULL)
+		fatal("out of memory");
 
 	evtimer_set(&tty->timer, tty_timer_callback, tty);
 
diff --git a/usr.bin/tmux/window.c b/usr.bin/tmux/window.c
index 998f2087e9a..a0ba831f299 100644
--- a/usr.bin/tmux/window.c
+++ b/usr.bin/tmux/window.c
@@ -997,6 +997,8 @@ window_pane_spawn(struct window_pane *wp, int argc, char **argv,
 
 	wp->event = bufferevent_new(wp->fd, window_pane_read_callback, NULL,
 	    window_pane_error_callback, wp);
+	if (wp->event == NULL)
+		fatalx("out of memory");
 
 	bufferevent_setwatermark(wp->event, EV_READ, 0, READ_SIZE);
 	bufferevent_enable(wp->event, EV_READ|EV_WRITE);

Places

File fix-cve201819387.patch of Package tmux (Revision 6847cd2193f0a33500868b210f0db5b9)

Places