From 9f28f1d93c444dce430ada01ff73d644bd62b063 Mon Sep 17 00:00:00 2001
From: 7c6f434c <7c6f434c@mail.ru>
Date: Mon, 24 Feb 2025 20:26:28 +0100
Subject: [PATCH] screen: fix the use of strncpy when using -X

SendCmdMessage in attacher.c used strncpy with increasing pointers into
the same buffer without reducing the available buffer size.
As the length is computed and checked already, use memcpy.
If the check fails, fail the operation instead of silent truncation of
the arguments sent.

Co-authored-by: Reno Dakota <paparodeo@proton.me>

Fixes: #384835

Related to: https://savannah.gnu.org/bugs/index.php?66215
Related to: https://savannah.gnu.org/bugs/index.php?66142
---
 .../screen/buffer-overflow-SendCmdMessage.patch     | 13 +++++++++++++
 pkgs/tools/misc/screen/default.nix                  |  7 +++++++
 2 files changed, 20 insertions(+)
 create mode 100644 pkgs/tools/misc/screen/buffer-overflow-SendCmdMessage.patch

diff --git a/pkgs/tools/misc/screen/buffer-overflow-SendCmdMessage.patch b/pkgs/tools/misc/screen/buffer-overflow-SendCmdMessage.patch
new file mode 100644
index 000000000000..c9a13d800017
--- /dev/null
+++ b/pkgs/tools/misc/screen/buffer-overflow-SendCmdMessage.patch
@@ -0,0 +1,13 @@
+--- a/attacher.c	2025-02-24 20:15:31.701820351 +0100
++++ b/attacher.c	2025-02-24 20:17:05.893826559 +0100
+@@ -461,8 +461,8 @@
+ 		size_t len;
+ 		len = strlen(*av) + 1;
+ 		if (p + len >= m.m.command.cmd + ARRAY_SIZE(m.m.command.cmd) - 1)
+-			break;
++			Panic(0, "Total length of the command to send too large.\n");
+-		strncpy(p, *av, MAXPATHLEN);
++		memcpy(p, *av, len);
+ 		p += len;
+ 	}
+ 	*p = 0;
diff --git a/pkgs/tools/misc/screen/default.nix b/pkgs/tools/misc/screen/default.nix
index 3c50af1fe6bf..7d32d467bfc1 100644
--- a/pkgs/tools/misc/screen/default.nix
+++ b/pkgs/tools/misc/screen/default.nix
@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
   # We need _GNU_SOURCE so that mallocmock_reset() is defined: https://savannah.gnu.org/bugs/?66416
   NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isGNU) "-D_GNU_SOURCE=1 -Wno-int-conversion -Wno-incompatible-pointer-types";
 
+  patches = [
+    # GNU Screen 5.0 uses strncpy incorrectly in SendCmdMessage
+    # This causes issues detected when using -D_FORTIFY_SOURCE=3
+    # e.g. https://savannah.gnu.org/bugs/index.php?66215
+    ./buffer-overflow-SendCmdMessage.patch
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
   ];