pyrox.dev
tmux: apply patch for CVE-2022-47016
Upstream issues:
https://github.com/tmux/tmux/issues/3312
https://github.com/tmux/tmux/issues/3447
Upstream patch does not apply cleanly on top of 3.3a.
+72
pkgs/tools/misc/tmux/CVE-2022-47016.patch
+72
pkgs/tools/misc/tmux/CVE-2022-47016.patch
···
1
+
From 01f753df5dc269cf054b94c3f210aa880872d602 Mon Sep 17 00:00:00 2001
2
+
From: nicm <nicm>
3
+
Date: Wed, 24 Aug 2022 07:22:30 +0000
4
+
Subject: [PATCH] Check for NULL returns from bufferevent_new.
5
+
6
+
(cherry picked from commit e86752820993a00e3d28350cbe46878ba95d9012)
7
+
---
8
+
control.c | 4 ++++
9
+
file.c | 4 ++++
10
+
window.c | 2 ++
11
+
3 files changed, 10 insertions(+)
12
+
13
+
diff --git a/control.c b/control.c
14
+
index 73286e00..6183a006 100644
15
+
--- a/control.c
16
+
+++ b/control.c
17
+
@@ -775,6 +775,8 @@ control_start(struct client *c)
18
+
19
+
cs->read_event = bufferevent_new(c->fd, control_read_callback,
20
+
control_write_callback, control_error_callback, c);
21
+
+ if (cs->read_event == NULL)
22
+
+ fatalx("out of memory");
23
+
bufferevent_enable(cs->read_event, EV_READ);
24
+
25
+
if (c->flags & CLIENT_CONTROLCONTROL)
26
+
@@ -782,6 +784,8 @@ control_start(struct client *c)
27
+
else {
28
+
cs->write_event = bufferevent_new(c->out_fd, NULL,
29
+
control_write_callback, control_error_callback, c);
30
+
+ if (cs->write_event == NULL)
31
+
+ fatalx("out of memory");
32
+
}
33
+
bufferevent_setwatermark(cs->write_event, EV_WRITE, CONTROL_BUFFER_LOW,
34
+
0);
35
+
diff --git a/file.c b/file.c
36
+
index b2f155fe..04a907bf 100644
37
+
--- a/file.c
38
+
+++ b/file.c
39
+
@@ -585,6 +585,8 @@ file_write_open(struct client_files *files, struct tmuxpeer *peer,
40
+
41
+
cf->event = bufferevent_new(cf->fd, NULL, file_write_callback,
42
+
file_write_error_callback, cf);
43
+
+ if (cf->event == NULL)
44
+
+ fatalx("out of memory");
45
+
bufferevent_enable(cf->event, EV_WRITE);
46
+
goto reply;
47
+
48
+
@@ -744,6 +746,8 @@ file_read_open(struct client_files *files, struct tmuxpeer *peer,
49
+
50
+
cf->event = bufferevent_new(cf->fd, file_read_callback, NULL,
51
+
file_read_error_callback, cf);
52
+
+ if (cf->event == NULL)
53
+
+ fatalx("out of memory");
54
+
bufferevent_enable(cf->event, EV_READ);
55
+
return;
56
+
57
+
diff --git a/window.c b/window.c
58
+
index c0cd9bdc..294a1f08 100644
59
+
--- a/window.c
60
+
+++ b/window.c
61
+
@@ -1042,6 +1042,8 @@ window_pane_set_event(struct window_pane *wp)
62
+
63
+
wp->event = bufferevent_new(wp->fd, window_pane_read_callback,
64
+
NULL, window_pane_error_callback, wp);
65
+
+ if (wp->event == NULL)
66
+
+ fatalx("out of memory");
67
+
wp->ictx = input_init(wp, wp->event, &wp->palette);
68
+
69
+
bufferevent_enable(wp->event, EV_READ|EV_WRITE);
70
+
--
71
+
2.39.1
72
+
+5
pkgs/tools/misc/tmux/default.nix
+5
pkgs/tools/misc/tmux/default.nix
···
1
1
{ lib
2
2
, stdenv
3
3
, fetchFromGitHub
4
+
, fetchpatch
4
5
, autoreconfHook
5
6
, bison
6
7
, libevent
···
34
35
rev = version;
35
36
sha256 = "sha256-SygHxTe7N4y7SdzKixPFQvqRRL57Fm8zWYHfTpW+yVY=";
36
37
};
38
+
39
+
patches = [
40
+
./CVE-2022-47016.patch
41
+
];
37
42
38
43
nativeBuildInputs = [
39
44
pkg-config