3 ms·

I think the mitigation advice is incomplete, allowFontOps is disabled by default, so the mitigation is only necessary if you've enabled it.. but in that case yo

by taviso 4y ago

I think the mitigation advice is incomplete, allowFontOps is disabled by default, so the mitigation is only necessary if you've enabled it.. but in that case you would need to put 'allowFontOps: false' after the stanza enabling it, right?

jwilk 4y ago
> allowFontOps is disabled by default It's enabled by default upstream. https://invisible-island.net/xterm/manpage/xterm.html#VT100-Widget-Resources:allowFontOps https://invisible-island.net/xterm/manpage/xterm.html#VT100-...
- taviso 4y ago
  That's what the manual on fedora says too, but it is disabled by default. I admit, I didn't try building from pristine source, so it could be patched!
  - jwilk 4y ago
    It looks patched indeed: https://src.fedoraproject.org/rpms/xterm/blob/rawhide/f/xterm-defaults.patch https://src.fedoraproject.org/rpms/xterm/blob/rawhide/f/xter...
    - taviso 4y ago
      Ah-ha, I stand corrected :)
      - dgl 4y ago
        Debian's patch is nicer, as the build process pulls the default from the man page, so: https://sources.debian.org/patches/xterm/375-1/904_fontops.diff/ https://sources.debian.org/patches/xterm/375-1/904_fontops.d...
        jwilk 4y ago
        > the build process pulls the default from the man page Interesting idea, but I don't think that's what happens: https://sources.debian.org/src/xterm/375-1/debian/rules/#L22 https://sources.debian.org/src/xterm/375-1/debian/rules/#L22