| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
using bit-mapped fonts.
Reported by Matthew Martin and fix confirmed by Thomas Dickey.
|
|
|
|
The "vt" prefix is optional for the default terminal ID.
Fixes an instance of "vtvt100" in the installed man page.
OK matthieu@
|
|
|
|
|
|
This further protects from CVE-2022-2602 (although allowFontOps where
disabled by default in OpenBSD since 2009).
|
|
and also tested by Walter Alejandro Iglesias
|
|
|
|
|
|
support of 30bpp displays with TrueType fonts
|
|
|
|
|
|
Discussed with deraadt@ ok millert@
|
|
|
|
spawn-new-terminal() functions.
|
|
utmp and wtmp files at startup. real-uid / effective-uid flipping was
used to cleanup the records in these two files at logout-time. Over
time it was recognized that setuid root is too dangerous, later on
even uid flipping became an unacceptable practice (because an attacker
who finds a bug will simply flip the uid back to root before
continuing exploitation). Some OS's helped xterm (and other similar
login-related tooling) by making utmp writeable by a new utmp group,
but most did not do the same for wtmp. xterm started using this new
utmp gid, and the wtmp code moved to "try, and if it fails, ignore the
failure".
The obvious way to use this uid is for xterm to open the utmp file for
write (early on), discard the egid, and keep the file descriptor
around until utmp cleanup at termination. 10-20 lines of code, maybe.
But no,.... that's not what happened.
The previous setuid root flipping code (which is nearly a hundred
lines of #ifdef-wrapped code for portability reasons) was copied and
repurposed by adding new #ifdef code for setgid utmp flipping, and
thus nearly a hundred lines of #ifdef-wrapped code was added). setgid
flipping has less severe security risks than setuid flipping, but it
is remains an excessively strong and unneccessary power (compared to a
single writeable fd).
When pledge() arrived on the scene, "wpath" was required so that the
utmp file could be opened late, and "id" was required to support egid
flipping. unveil() arrived on the scene, and the utmp path was added
to the list of viable paths, once again not considering that an incorrect
approach was being taken by the code.
I tried rewriting the portable USE_UTMP_SETGID code to follow the
open-drop-reuse-fd approach, to help out upstream xterm, but it is such
a brain-melting shitshow I gave up, we'll have a (small) intrusive patch
which opens utmp early, drops the gid, and reuses the fd later on.
Maybe upstream will take care of this eventually to reduce the risk of
egid other operating systems.
ok matthieu, much feedback from millert
|
|
because we dropped setuid root around the, but the code to attempt it
it was erroneously left behind
ok matthieu
|
|
ok matthieu
|
|
ok matthieu
|
|
the top-level features are disabled because our xterm uses pledge
without "exec" support.
ok matthieu
|
|
|
|
This code is not compiled on OpenBSD so the shipped xterm are not
vulnerable to this (which is CVE-2022-24130)
Committing the fix in case someone uses this for builds with sixel enabled.
|
|
This causes extra control sequences to be sent to the shell when an
application that has it enabled crashes. Discussed with deraadt@
|
|
|
|
|
|
Only in (default) case where there are no exec-formatted or
exec-selected resources set. In those case the commands and their
arguments could be anywhere.
|
|
CharWidth is a conditional wrapper that assumes that all wide characters
in the range 32-126 and 160-255) are latin-1 characters and are identical
with the unicode (UTF-8) codepoints and result in a width of 1.
This is correct in so far that the names of these code-points are
identical, but for SHY (soft-hyphen) the explanation of how it should be
used differs between unicode and latin-1. Latin-1 assumes that it's always
displayed, for unicode it should only be displayed after local grammar
rules apply.
This wrapper got introduced in xterm #334 and is on the short-list of Thomas
Dickey to fix. Since we don't know when the next release is going to be,
commit this one now, so we have it fixed before 7.0.
Originally discrepency between xterm and wcwidth(3) pointed out by Lauri
Tirkkonen (lauri <at> hacktheplanet <dot> fi).
OK matthieu@
|
|
|
|
|
|
|
|
Found while testing xterm 363
|
|
Found while testing upgrade to version 363.
|
|
|
|
|
|
They a causing a pledge violation when called, and we can live without
them. ok millert, also discussed with deraadt@
|
|
They got enabled in previous xterm update but we don't want those.
PASTE64 issue and patch by deraadt@, discussed also with nicm@
|
|
|
|
with tweaks from kn@.
|
|
that comes bundled with xterm(1).
Issue found and based on a diff from Lauri Tirkkonen <lotheac at iki dot fi>.
The final form of the diff follows a suggestion from tedu@.
OK matthieu@
|
|
* Add the missing locale, modifyFunctionKeys, precompose, and scrollBar.
* Move backarrowKeyIsErase to conform to alphabetical sorting.
* Add a missing full stop.
Diff found in my tree; i obviously forgot to commit it earlier.
|
|
|
|
|
|
readline was not enabled, but paste64 which was on by default enables it.
requested by deraadt@
|
|
This is more coherent with how the menu item interacts with changes
caused by sending escape sequences. Remove the check mark from the
item which was getting out of sync.
|
|
Fix from Thomas Dickey.
|
|
|
|
|
|
|
