diff options
| author | Kees Cook <kees@ubuntu.com> | 2010-07-12 21:31:32 +0200 |
|---|---|---|
| committer | Christian Persch <chpe@gnome.org> | 2010-07-12 21:42:42 +0200 |
| commit | 814376a88e235fe2d86a6b7bb4a65e16d8f68f4f (patch) | |
| tree | e1c165fbbe53c7c1d3db2623f350d216099cca68 | |
| parent | 1c7586456fc9fadb3b3c54be89bbd98cf63a8741 (diff) | |
| download | vte-0-22.tar.gz | |
Fix terminal title reportingvte-0-22
Fixed CVE-2003-0070 again.
See also http://marc.info/?l=bugtraq&m=104612710031920&w=2 .
(cherry picked from commit 6042c75b5a6daa0e499e61c8e07242d890d38ff1)
| -rw-r--r-- | src/vteseq.c | 24 |
1 files changed, 16 insertions, 8 deletions
diff --git a/src/vteseq.c b/src/vteseq.c index 370077af..6624762f 100644 --- a/src/vteseq.c +++ b/src/vteseq.c @@ -3168,21 +3168,29 @@ vte_sequence_handler_window_manipulation (VteTerminal *terminal, GValueArray *pa vte_terminal_feed_child(terminal, buf, -1); break; case 20: - /* Report the icon title. */ + /* Report a static icon title, since the real + icon title should NEVER be reported, as it + creates a security vulnerability. See + http://marc.info/?l=bugtraq&m=104612710031920&w=2 + and CVE-2003-0070. */ _vte_debug_print(VTE_DEBUG_PARSE, - "Reporting icon title.\n"); + "Reporting fake icon title.\n"); + /* never use terminal->icon_title here! */ g_snprintf (buf, sizeof (buf), - _VTE_CAP_OSC "L%s" _VTE_CAP_ST, - terminal->icon_title); + _VTE_CAP_OSC "LTerminal" _VTE_CAP_ST); vte_terminal_feed_child(terminal, buf, -1); break; case 21: - /* Report the window title. */ + /* Report a static window title, since the real + window title should NEVER be reported, as it + creates a security vulnerability. See + http://marc.info/?l=bugtraq&m=104612710031920&w=2 + and CVE-2003-0070. */ _vte_debug_print(VTE_DEBUG_PARSE, - "Reporting window title.\n"); + "Reporting fake window title.\n"); + /* never use terminal->window_title here! */ g_snprintf (buf, sizeof (buf), - _VTE_CAP_OSC "l%s" _VTE_CAP_ST, - terminal->window_title); + _VTE_CAP_OSC "lTerminal" _VTE_CAP_ST); vte_terminal_feed_child(terminal, buf, -1); break; default: |