Merge ~paelzer/ubuntu/+source/slang2:ubuntu/xenial-devel into ubuntu/+source/slang2:ubuntu/xenial-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA [1] to test the fix according to the repro steps that I added as part of the SRU template.

[1]: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3309

[Andreas Hasenack (ahasenack)]

+1, and fix confirmed as well with packages from the ppa.

review: Approve

[Christian Ehrhardt  (paelzer)]

Tagged and Uploaded

diff --git a/debian/changelog b/debian/changelog
index 45577c8..f5b880a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+slang2 (2.3.0-2ubuntu1.1) xenial; urgency=medium
+
+  * d/p/init-crash.patch: Fix crash on multuple initialisation when TERMCAP
+    set (LP: #1537528)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 28 Jun 2018 11:06:04 +0200
+
 slang2 (2.3.0-2ubuntu1) vivid; urgency=low
 
   * Merge from Debian unstable.  Remaining changes:
diff --git a/debian/patches/init-crash.patch b/debian/patches/init-crash.patch
new file mode 100644
index 0000000..69dd820
--- /dev/null
+++ b/debian/patches/init-crash.patch
@@ -0,0 +1,99 @@
+Description: Fix crash on multuple initialisation when TERMCAP set
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837868
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/byobu/+bug/1537528
+Origin: https://salsa.debian.org/debian/slang2/blob/debian/master/debian/patches/init-crash.patch
+Forwarded: No
+Author: Alastair McKinstry <[e-mail]>
+Last-Update: 2018-06-28
+
+--- a/src/sltermin.c
++++ b/src/sltermin.c
+@@ -546,13 +546,10 @@ static int tcap_getent (SLCONST char *te
+    if (NULL == (buf = (unsigned char *) SLmalloc (ulen)))
+      return -1;
+ 
+-   b = buf;
+-
+    /* The beginning of the termcap entry contains the names of the entry.
+     * It is terminated by a colon.
+     */
+ 
+-   ti->terminal_names = (char *) b;
+    t = termcap;
+    len = tcap_extract_field (t);
+    if (len < 0)
+@@ -560,9 +557,9 @@ static int tcap_getent (SLCONST char *te
+ 	SLfree ((char *)buf);
+ 	return -1;
+      }
+-   strncpy ((char *) b, (char *) t, (unsigned int) len);
+-   b[len] = 0;
+-   b += len + 1;
++   ti->terminal_names = SLmalloc (len + 1);
++   strncpy (ti->terminal_names, (char *) t, (unsigned int) len);
++   ti->terminal_names[len] = 0;
+    ti->name_section_size = len;
+ 
+    /* Now, we are really at the start of the termcap entries.  Point the
+@@ -571,7 +568,7 @@ static int tcap_getent (SLCONST char *te
+    termcap = t + (len + 1);
+ 
+    /* Process strings first. */
+-   ti->string_table = (char *) b;
++   b = buf;
+    t = termcap;
+    while (-1 != (len = tcap_extract_field (t)))
+      {
+@@ -597,6 +594,7 @@ static int tcap_getent (SLCONST char *te
+ 		  t = (unsigned char *) _pSLexpand_escaped_char ((char *) t, (char *) tmax, &wch, NULL);
+ 		  if (t == NULL)
+ 		    {
++		       SLfree (ti->terminal_names);
+ 		       SLfree ((char *)buf);
+ 		       return -1;
+ 		    }
+@@ -617,12 +615,14 @@ static int tcap_getent (SLCONST char *te
+ 	/* skip colon to next field. */
+ 	t++;
+      }
+-   ti->string_table_size = (int) (b - (unsigned char *) ti->string_table);
++   ti->string_table_size = (int) (b - buf);
++   ti->string_table = SLmalloc (ti->string_table_size);
++   memcpy (ti->string_table, buf, ti->string_table_size);
+ 
+    /* Now process the numbers. */
+ 
+    t = termcap;
+-   ti->numbers = b;
++   b = buf;
+    while (-1 != (len = tcap_extract_field (t)))
+      {
+ 	unsigned char *b1;
+@@ -647,11 +647,13 @@ static int tcap_getent (SLCONST char *te
+ 	b1[2] = (unsigned char) len;    /* replace the # by the length */
+ 	t++;
+      }
+-   ti->num_numbers = (b - ti->numbers);
++   ti->num_numbers = (b - buf);
++   ti->numbers = SLmalloc (ti->num_numbers);
++   memcpy (ti->numbers, buf, ti->num_numbers);
+ 
+    /* Now process the flags. */
+    t = termcap;
+-   ti->boolean_flags = b;
++   b = buf;
+    while (-1 != (len = tcap_extract_field (t)))
+      {
+ 	/* We are looking for: XX#NUMBER */
+@@ -665,7 +667,10 @@ static int tcap_getent (SLCONST char *te
+ 	t += 3;
+ 	b += 2;
+      }
+-   ti->boolean_section_size = (b - ti->boolean_flags);
++   ti->boolean_section_size = (b - buf);
++   ti->boolean_flags = SLmalloc (ti->boolean_section_size);
++   memcpy (ti->boolean_flags, buf, ti->boolean_section_size);
++   SLfree ((char *)buf);
+    ti->flags = SLTERMCAP;
+    return 0;
+ }
diff --git a/debian/patches/series b/debian/patches/series
index 80ca793..d233ebd 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -5,3 +5,4 @@ typos.patch
 dso_linking.patch
 fix_glibc.patch
 segv_fix.patch
+init-crash.patch