core: add CVE id in ChangeLog

This reverts commit dff1bf6f0f5521cf9e23e2b32a648512e13b6a72.

(cherry picked from commit 08ebc99dea511cccba7d810c529e5218e5a2534c)

.github/workflows/ci.yml

@@ -7,7 +7,7 @@ jobs:
   build:
 
     name: ${{ matrix.config.name }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-18.04
     strategy:
       fail-fast: false
       matrix:

ChangeLog.adoc

@@ -15,6 +15,22 @@ https://weechat.org/files/releasenotes/ReleaseNotes-devel.html[release notes]
 (file _ReleaseNotes.adoc_ in sources).
 
 
+[[v3.0.2]]
+== Version 3.0.2 (under dev)
+
+Bug fixes::
+
+  * relay: fix crash when decoding a malformed websocket frame (CVE-2021-40516)
+
+[[v3.0.1]]
+== Version 3.0.1 (2021-01-31)
+
+Bug fixes::
+
+  * exec: fix search of command by identifier
+  * spell: fix refresh of bar item "spell_suggest" when the input becomes empty (issue #1586)
+  * spell: fix crash with IRC color codes in command line (issue #1589)
+
 [[v3.0]]
 == Version 3.0 (2020-11-11)
 

ReleaseNotes.adoc

@@ -17,6 +17,11 @@ https://weechat.org/files/changelog/ChangeLog-devel.html[ChangeLog]
 (file _ChangeLog.adoc_ in sources).
 
 
+[[v3.0.1]]
+== Version 3.0.1 (2021-01-31)
+
+Bug fix and maintenance release.
+
 [[v3.0]]
 == Version 3.0 (2020-11-11)
 

src/plugins/exec/exec.c

@@ -89,7 +89,7 @@ exec_search_by_id (const char *id)
     error = NULL;
     number = strtol (id, &error, 10);
     if (!error || error[0])
-        return NULL;
+        number = -1;
 
     for (ptr_exec_cmd = exec_cmds; ptr_exec_cmd;
          ptr_exec_cmd = ptr_exec_cmd->next_cmd)

src/plugins/relay/relay-websocket.c

@@ -278,7 +278,7 @@ relay_websocket_decode_frame (const unsigned char *buffer,
     index_buffer = 0;
 
     /* loop to decode all frames in message */
-    while (index_buffer + 2 <= buffer_length)
+    while (index_buffer + 1 < buffer_length)
     {
         opcode = buffer[index_buffer] & 15;
 
@@ -293,10 +293,12 @@ relay_websocket_decode_frame (const unsigned char *buffer,
         length_frame_size = 1;
         length_frame = buffer[index_buffer + 1] & 127;
         index_buffer += 2;
+        if (index_buffer >= buffer_length)
+            return 0;
         if ((length_frame == 126) || (length_frame == 127))
         {
             length_frame_size = (length_frame == 126) ? 2 : 8;
-            if (buffer_length < 1 + length_frame_size)
+            if (index_buffer + length_frame_size > buffer_length)
                 return 0;
             length_frame = 0;
             for (i = 0; i < length_frame_size; i++)
@@ -306,10 +308,9 @@ relay_websocket_decode_frame (const unsigned char *buffer,
             index_buffer += length_frame_size;
         }
 
-        if (buffer_length < 1 + length_frame_size + 4 + length_frame)
-            return 0;
-
         /* read masks (4 bytes) */
+        if (index_buffer + 4 > buffer_length)
+            return 0;
         int masks[4];
         for (i = 0; i < 4; i++)
         {
@@ -333,6 +334,11 @@ relay_websocket_decode_frame (const unsigned char *buffer,
         *decoded_length += 1;
 
         /* decode data using masks */
+        if ((length_frame > buffer_length)
+            || (index_buffer + length_frame > buffer_length))
+        {
+            return 0;
+        }
         for (i = 0; i < length_frame; i++)
         {
             decoded[*decoded_length + i] = (int)((unsigned char)buffer[index_buffer + i]) ^ masks[i % 4];

src/plugins/spell/spell.c

@@ -649,7 +649,7 @@ spell_skip_color_codes (char **string, char **result)
 {
     int color_code_size;
 
-    while (*string[0])
+    while ((*string)[0])
     {
         color_code_size = weechat_string_color_code_size (*string);
         if (color_code_size > 0)
@@ -658,9 +658,9 @@ spell_skip_color_codes (char **string, char **result)
             weechat_string_dyn_concat (result, *string, color_code_size);
             (*string) += color_code_size;
         }
-        else if (*string[0] == '\x02' || *string[0] == '\x0F'
+        else if ((*string)[0] == '\x02' || (*string)[0] == '\x0F'
-                 || *string[0] == '\x11' || *string[0] == '\x16'
+                 || (*string)[0] == '\x11' || (*string)[0] == '\x16'
-                 || *string[0] == '\x1D' || *string[0] == '\x1F')
+                 || (*string)[0] == '\x1D' || (*string)[0] == '\x1F')
         {
             /*
              * IRC attribute:
@@ -674,28 +674,29 @@ spell_skip_color_codes (char **string, char **result)
             weechat_string_dyn_concat (result, *string, 1);
             (*string)++;
         }
-        else if (*string[0] == '\x03')
+        else if ((*string)[0] == '\x03')
         {
             /* IRC color code */
             weechat_string_dyn_concat (result, *string, 1);
             (*string)++;
-            if (isdigit (*string[0]))
+            if (isdigit ((unsigned char)((*string)[0])))
             {
                 /* foreground */
                 weechat_string_dyn_concat (result, *string, 1);
                 (*string)++;
-                if (isdigit (*string[0]))
+                if (isdigit ((unsigned char)((*string)[0])))
                 {
                     weechat_string_dyn_concat (result, *string, 1);
                     (*string)++;
                 }
             }
-            if ((*string[0] == ',') && (isdigit (*string[1])))
+            if (((*string)[0] == ',')
+                && (isdigit ((unsigned char)((*string)[1]))))
             {
                 /* background */
                 weechat_string_dyn_concat (result, *string, 1);
                 (*string)++;
-                if (isdigit (*string[0]))
+                if (isdigit ((unsigned char)((*string)[0])))
                 {
                     weechat_string_dyn_concat (result, *string, 1);
                     (*string)++;
@@ -801,7 +802,7 @@ spell_modifier_cb (const void *pointer, void *data,
     color_error = weechat_color (weechat_config_string (spell_config_color_misspelled));
 
     length = strlen (string);
-    result = weechat_string_dyn_alloc (length * 2);
+    result = weechat_string_dyn_alloc ((length * 2) + 1);
     if (!result)
         return NULL;
 

version.sh

@@ -32,9 +32,9 @@
 #     devel-patch  the patch version of devel (e.g. 2 for version 1.4.2)
 #
 
-WEECHAT_STABLE=3.0
+WEECHAT_STABLE=3.0.1
-WEECHAT_DEVEL=3.0
+WEECHAT_DEVEL=3.0.2
-WEECHAT_DEVEL_FULL=3.0
+WEECHAT_DEVEL_FULL=3.0.2-dev
 
 if [ $# -lt 1 ]; then
     echo >&2 "Syntax: $0 stable|devel|devel-full|devel-major|devel-minor|devel-patch"

weechat.spec

@@ -23,7 +23,7 @@
 #
 
 %define name weechat
-%define version 3.0
+%define version 3.0.1
 %define release 1
 
 Name:      %{name}
@@ -82,6 +82,8 @@ rm -rf $RPM_BUILD_ROOT
 %{_prefix}/share/icons/hicolor/512x512/apps/weechat.png
 
 %changelog
+* Sun Jan 31 2021 Sébastien Helleu <flashcode@flashtux.org> 3.0.1-1
+- Released version 3.0.1
 * Wed Nov 11 2020 Sébastien Helleu <flashcode@flashtux.org> 3.0-1
 - Released version 3.0
 * Sat Jul 18 2020 Sébastien Helleu <flashcode@flashtux.org> 2.9-1