gentoo-locomotion/app-misc/tmux/files/tmux-CVE-2022-40716.patch

From 94da0240d2ba4ad4be2a02adee5d297941aa4acc Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 28 Jan 2023 00:24:50 +0100
Subject: [PATCH] tmux: apply patch for CVE-2022-47016

Upstream issues:
https://github.com/tmux/tmux/issues/3312
https://github.com/tmux/tmux/issues/3447

Upstream patch does not apply cleanly on top of 3.3a.
---
 pkgs/tools/misc/tmux/CVE-2022-47016.patch | 72 +++++++++++++++++++++++
 pkgs/tools/misc/tmux/default.nix          |  5 ++
 2 files changed, 77 insertions(+)
 create mode 100644 pkgs/tools/misc/tmux/CVE-2022-47016.patch

diff --git a/control.c b/control.c
index 73286e00..6183a006 100644
--- a/control.c
+++ b/control.c
@@ -775,6 +775,8 @@ control_start(struct client *c)
 
 	cs->read_event = bufferevent_new(c->fd, control_read_callback,
 	    control_write_callback, control_error_callback, c);
+	if (cs->read_event == NULL)
+		fatalx("out of memory");
 	bufferevent_enable(cs->read_event, EV_READ);
 
 	if (c->flags & CLIENT_CONTROLCONTROL)
@@ -782,6 +784,8 @@ control_start(struct client *c)
 	else {
 		cs->write_event = bufferevent_new(c->out_fd, NULL,
 		    control_write_callback, control_error_callback, c);
+		if (cs->write_event == NULL)
+			fatalx("out of memory");
 	}
 	bufferevent_setwatermark(cs->write_event, EV_WRITE, CONTROL_BUFFER_LOW,
 	    0);
diff --git a/file.c b/file.c
index b2f155fe..04a907bf 100644
--- a/file.c
+++ b/file.c
@@ -585,6 +585,8 @@ file_write_open(struct client_files *files, struct tmuxpeer *peer,
 
 	cf->event = bufferevent_new(cf->fd, NULL, file_write_callback,
 	    file_write_error_callback, cf);
+	if (cf->event == NULL)
+		fatalx("out of memory");
 	bufferevent_enable(cf->event, EV_WRITE);
 	goto reply;
 
@@ -744,6 +746,8 @@ file_read_open(struct client_files *files, struct tmuxpeer *peer,
 
 	cf->event = bufferevent_new(cf->fd, file_read_callback, NULL,
 	    file_read_error_callback, cf);
+	if (cf->event == NULL)
+		fatalx("out of memory");
 	bufferevent_enable(cf->event, EV_READ);
 	return;
 
diff --git a/window.c b/window.c
index c0cd9bdc..294a1f08 100644
--- a/window.c
+++ b/window.c
@@ -1042,6 +1042,8 @@ window_pane_set_event(struct window_pane *wp)
 
 	wp->event = bufferevent_new(wp->fd, window_pane_read_callback,
 	    NULL, window_pane_error_callback, wp);
+	if (wp->event == NULL)
+		fatalx("out of memory");
 	wp->ictx = input_init(wp, wp->event, &wp->palette);
 
 	bufferevent_enable(wp->event, EV_READ|EV_WRITE);
-- 
2.39.1