francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
110 lines
3.3 KiB
Diff
110 lines
3.3 KiB
Diff
From fc2262e1c1847021239065e84f39f15492ef05cc Mon Sep 17 00:00:00 2001
|
|
From: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Date: Mon, 1 Jun 2026 10:12:29 +1000
|
|
Subject: [PATCH] util: sanitize control characters in str_sanitize()
|
|
|
|
str_sanitize() only escaped '%' characters for format string safety.
|
|
Device names from uinput devices can contain arbitrary bytes including
|
|
ANSI escape sequences (ESC, 0x1b) and other control characters. When
|
|
these strings are included in log messages and printed to a terminal,
|
|
the escape sequences are interpreted by the terminal emulator. This
|
|
could allow an attacker to manipulate terminal output (change colors,
|
|
set window title, clear screen) when an administrator views libinput
|
|
logs.
|
|
|
|
Replace all control characters (0x00-0x1f and 0x7f) with '?' in
|
|
addition to the existing '%' escaping. This prevents terminal escape
|
|
sequence injection through device names in log output.
|
|
|
|
Assisted-by: Claude:claude-opus-4-6
|
|
(cherry picked from commit 71a2c5cae2a80a1e3bb29e3f3a07ccc3f3de5acb)
|
|
|
|
Part-of: <https://gitlab.freedesktop.org/libinput/libinput/-/merge_requests/1489>
|
|
|
|
CVE: CVE-2026-50292
|
|
Upstream-Status: Backport [https://gitlab.freedesktop.org/libinput/libinput/-/commit/fc2262e1c1847021239065e84f39f15492ef05cc]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
src/util-strings.h | 30 +++++++++++++++++++++++-------
|
|
test/test-utils.c | 10 ++++++++++
|
|
2 files changed, 33 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/src/util-strings.h b/src/util-strings.h
|
|
index b0916815..3429ec9c 100644
|
|
--- a/src/util-strings.h
|
|
+++ b/src/util-strings.h
|
|
@@ -456,26 +456,42 @@ trunkname(const char *filename);
|
|
|
|
/**
|
|
* Return a copy of str with all % converted to %% to make the string
|
|
- * acceptable as printf format.
|
|
+ * acceptable as printf format, and all non-NUL control characters
|
|
+ * (bytes 0x01-0x1f, 0x7f) replaced with '?' to prevent terminal
|
|
+ * escape sequence injection. NUL bytes are excluded implicitly
|
|
+ * because the string is null-terminated.
|
|
*/
|
|
static inline char *
|
|
str_sanitize(const char *str)
|
|
{
|
|
if (!str)
|
|
return NULL;
|
|
+ size_t slen = strlen(str);
|
|
+ slen = min(slen, 512);
|
|
|
|
- if (!strchr(str, '%'))
|
|
+ bool needs_sanitization = false;
|
|
+ for (size_t i = 0; i < slen; i++) {
|
|
+ unsigned char c = str[i];
|
|
+ if (c == '%' || c < 0x20 || c == 0x7f) {
|
|
+ needs_sanitization = true;
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
+ if (!needs_sanitization)
|
|
return strdup(str);
|
|
-
|
|
- size_t slen = min(strlen(str), 512);
|
|
char *sanitized = zalloc(2 * slen + 1);
|
|
const char *src = str;
|
|
char *dst = sanitized;
|
|
-
|
|
for (size_t i = 0; i < slen; i++) {
|
|
- if (*src == '%')
|
|
+ unsigned char c = *src++;
|
|
+ if (c == '%') {
|
|
*dst++ = '%';
|
|
- *dst++ = *src++;
|
|
+ *dst++ = '%';
|
|
+ } else if (c < 0x20 || c == 0x7f) {
|
|
+ *dst++ = '?';
|
|
+ } else {
|
|
+ *dst++ = c;
|
|
+ }
|
|
}
|
|
*dst = '\0';
|
|
|
|
diff --git a/test/test-utils.c b/test/test-utils.c
|
|
index fa307031..88aede23 100644
|
|
--- a/test/test-utils.c
|
|
+++ b/test/test-utils.c
|
|
@@ -1388,6 +1388,16 @@ START_TEST(strsanitize_test)
|
|
{ "x %", "x %%" },
|
|
{ "%sx", "%%sx" },
|
|
{ "%s%s", "%%s%%s" },
|
|
+ { "\t", "?" },
|
|
+ { "\n", "?" },
|
|
+ { "\r", "?" },
|
|
+ { "\x1b[31m", "?[31m" },
|
|
+ { "foo\tbar", "foo?bar" },
|
|
+ { "foo\nbar", "foo?bar" },
|
|
+ { "\x01\x1f\x7f", "???" },
|
|
+ { "clean", "clean" },
|
|
+ { "a\x1b[0mb", "a?[0mb" },
|
|
+ { "%\n", "%%?" },
|
|
{ NULL, NULL },
|
|
};
|
|
|
|
--
|
|
2.50.1
|
|
|