Submitted By:            Douglas R. Reno <renodr at linuxfromscratch dot org>
Date:                    2021-02-19
Initial Package Version: 4.8.0
Origin:                  Upstream Mailing List (https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00010.html)
Upstream Status:         Applied
Description:             Patches Screen against CVE-2021-26937

diff -Naurp screen-4.8.0.orig/ansi.c screen-4.8.0/ansi.c
--- screen-4.8.0.orig/ansi.c	2020-02-05 14:09:38.000000000 -0600
+++ screen-4.8.0/ansi.c	2021-02-19 12:26:21.261569981 -0600
@@ -692,10 +692,6 @@ register int len;
 		    }
 		  curr->w_rend.font = 0;
 		}
-#  ifdef DW_CHARS
-	      if (curr->w_encoding == UTF8 && utf8_isdouble(c))
-		curr->w_mbcs = 0xff;
-#  endif
 	      if (curr->w_encoding == UTF8 && c >= 0x0300 && utf8_iscomb(c))
 		{
 		  int ox, oy;
@@ -730,6 +726,10 @@ register int len;
 		    }
 		  break;
 		}
+# ifdef DW_CHARS
+         if (curr->w_encoding == UTF8 && utf8_isdouble(c))
+            curr->w_mbcs = 0xff;
+#endif
 	      font = curr->w_rend.font;
 # endif
 # ifdef DW_CHARS
diff -Naurp screen-4.8.0.orig/encoding.c screen-4.8.0/encoding.c
--- screen-4.8.0.orig/encoding.c	2020-02-05 14:09:38.000000000 -0600
+++ screen-4.8.0/encoding.c	2021-02-19 12:25:07.382075190 -0600
@@ -43,7 +43,7 @@ static int  encmatch __P((char *, char *
 # ifdef UTF8
 static int   recode_char __P((int, int, int));
 static int   recode_char_to_encoding __P((int, int));
-static void  comb_tofront __P((int, int));
+static void  comb_tofront __P((int));
 #  ifdef DW_CHARS
 static int   recode_char_dw __P((int, int *, int, int));
 static int   recode_char_dw_to_encoding __P((int, int *, int));
@@ -1263,6 +1263,8 @@ int c;
     {0x30000, 0x3FFFD},
   };
 
+  if (c >= 0xdf00 && c <= 0xdfff)
+     return 1; /* dw combining sequence */
   return ((bisearch(c, wide, sizeof(wide) / sizeof(struct interval) - 1)) ||
           (cjkwidth &&
            bisearch(c, ambiguous,
@@ -1330,11 +1332,12 @@ int c;
 }
 
 static void
-comb_tofront(root, i)
-int root, i;
+comb_tofront(i)
+int i;
 {
   for (;;)
     {
+      int root = i >= 0x700 ? 0x801 : 0x800;
       debug1("bring to front: %x\n", i);
       combchars[combchars[i]->prev]->next = combchars[i]->next;
       combchars[combchars[i]->next]->prev = combchars[i]->prev;
@@ -1396,9 +1399,9 @@ struct mchar *mc;
     {
       /* full, recycle old entry */
       if (c1 >= 0xd800 && c1 < 0xe000)
-        comb_tofront(root, c1 - 0xd800);
+        comb_tofront(c1 - 0xd800);
       i = combchars[root]->prev;
-      if (c1 == i + 0xd800)
+      if (i == 0x800 || i == 0x801 || c1 == i + 0xd800)
 	{
 	  /* completely full, can't recycle */
 	  debug("utf8_handle_comp: completely full!\n");
@@ -1422,7 +1425,7 @@ struct mchar *mc;
   mc->font  = (i >> 8) + 0xd8;
   mc->fontx = 0;
   debug3("combinig char %x %x -> %x\n", c1, c, i + 0xd800);
-  comb_tofront(root, i);
+  comb_tofront(i);
 }
 
 #else /* !UTF8 */