[Git][java-team/jline3][master] 8 commits: Upload 3.29.0+ds-2: 3.29.0+ds-1 is still in NEW
Simon Quigley (@tsimonq2)
gitlab at salsa.debian.org
Tue Nov 3 00:03:24 GMT 2026
Simon Quigley pushed to branch master at Debian Java Maintainers / jline3
Commits:
d4ee18c7 by Juan Manuel Méndez Rey at 2026-10-28T15:43:47+01:00
Upload 3.29.0+ds-2: 3.29.0+ds-1 is still in NEW
- - - - -
7c33cd96 by Juan Manuel Méndez Rey at 2026-10-28T23:13:34+01:00
Add myself to Uploaders
- - - - -
40690f37 by Juan Manuel Méndez Rey at 2026-10-28T23:25:48+01:00
d/changelog: -2 only adds me to Uploaders; the copyright fixes are in -1
- - - - -
b84b5ba2 by Juan Manuel Méndez Rey at 2026-10-29T01:34:36+01:00
Run the upstream test suite
The NEW review pointed out that nothing compiles or runs the 93 test files:
debian/maven.properties carried maven.test.skip=true. Debian has what the
suite needs, junit5 5.14.4-2 ships junit-jupiter-api, -params and -engine with
a debian version, and libsurefire-java ships the junit-platform provider.
Also names the 2026 packaging work in Files: debian/*, which the same review
asked for.
- - - - -
4e9399a1 by Juan Manuel Méndez Rey at 2026-10-29T01:41:02+01:00
Stop stripping easymock, one test needs it
debian/maven.ignoreRules removed org.easymock from the POMs outright, so
PosixSysTerminalTest could not compile however the dependency was installed.
Debian has 5.5.0-1, the version upstream asks for.
- - - - -
c69f81c0 by Juan Manuel Méndez Rey at 2026-10-29T01:55:21+01:00
Point the test JVM at the library we build
The loader searches java.library.path, which holds /usr/lib/<triplet>/jni only
once the package is installed. pom.xml hardcodes argLine, so -DargLine never
reaches surefire, while LD_LIBRARY_PATH does.
FfmTest cannot call openpty() in a chroot and
JansiTerminalProviderTest#testIsSystemStream needs the native library of jansi,
so both are skipped.
- - - - -
bd6ccbe9 by Juan Manuel Méndez Rey at 2026-10-29T14:12:20+01:00
Backport the remote-telnet fixes for CVE-2026-56740 and CVE-2026-56741
Upstream 4ee3a738 (jline-3.30.14) plus the cross-frame follow-up
66662bd0 with its regression test. Also close #1059726: CVE-2023-50572
was fixed in 3.25.0.
- - - - -
2917d3d4 by Juan Manuel Méndez Rey at 2026-11-03T00:56:01+01:00
Split the CVE patches by id and lead the changelog bullets with the id
- - - - -
11 changed files:
- debian/changelog
- debian/control
- debian/copyright
- debian/maven.ignoreRules
- debian/maven.properties
- debian/maven.rules
- + debian/patches/CVE-2026-56740-66662bd0.patch
- + debian/patches/CVE-2026-56740.patch
- + debian/patches/CVE-2026-56741.patch
- debian/patches/series
- debian/rules
Changes:
=====================================
debian/changelog
=====================================
@@ -1,3 +1,23 @@
+jline3 (3.29.0+ds-2) unstable; urgency=medium
+
+ * Add myself to Uploaders.
+ * d/copyright: name the 2026 packaging work in Files: debian/*.
+ * Run the upstream test suite: drop maven.test.skip, build-depend on junit5
+ and libeasymock-java, map their artifacts in d/maven.rules, and stop
+ stripping easymock in d/maven.ignoreRules.
+ * Point the test JVM at the JNI library we build, so the tests that load it
+ run against the one we ship.
+ * Skip FfmTest and JansiTerminalProviderTest#testIsSystemStream, which need
+ a pty and the native library of jansi.
+ * CVE-2026-56740: Cap NEW-ENVIRON variables at 100, including across
+ subnegotiations (Closes: #1143458).
+ * CVE-2026-56741: Reset NAWS sizes above 500 columns or rows to the
+ default.
+ * CVE-2023-50572: Already fixed upstream in 3.25.0, and the groovy
+ module is not built (Closes: #1059726).
+
+ -- Juan Manuel Méndez Rey <juan.mendezr at proton.me> Thu, 29 Oct 2026 01:34:28 +0100
+
jline3 (3.29.0+ds-1) unstable; urgency=medium
* Team upload.
=====================================
debian/control
=====================================
@@ -3,7 +3,8 @@ Section: java
Maintainer: Debian Java Maintainers <pkg-java-maintainers at lists.alioth.debian.org>
Uploaders:
Saif Abdul Cassim <saif.15 at cse.mrt.ac.lk>,
- Samyak Jain <samyak.jn11 at gmail.com>
+ Samyak Jain <samyak.jn11 at gmail.com>,
+ Juan Manuel Méndez Rey <juan.mendezr at proton.me>,
Build-Depends:
debhelper-compat (= 13),
default-jdk-headless,
@@ -11,6 +12,8 @@ Build-Depends:
libjansi-java,
libjna-java,
libjsr305-java,
+ junit5,
+ libeasymock-java,
libjuniversalchardet-java,
libmaven-bundle-plugin-java,
libmaven-dependency-plugin-java,
=====================================
debian/copyright
=====================================
@@ -251,6 +251,7 @@ Comment:
Files: debian/*
Copyright: 2019, Saif Abdul Cassim <saif.15 at cse.mrt.ac.lk>
2020, Samyak Jain <samyak.jn11 at gmail.com>
+ 2026, Juan Manuel Méndez Rey <juan.mendezr at proton.me>
License: BSD-3-clause
Comment:
The Debian packaging is licensed under the same terms as the upstream project.
=====================================
debian/maven.ignoreRules
=====================================
@@ -3,7 +3,6 @@ junit junit * * * *
org.apache.maven.plugins maven-enforcer-plugin * * * *
org.apache.maven.plugins maven-javadoc-plugin * * * *
org.apache.maven.plugins maven-gpg-plugin * * * *
-org.easymock easymock * * * *
com.diffplug.spotless spotless-maven-plugin * * * *
com.mycila license-maven-plugin * * * *
org.codehaus.mojo exec-maven-plugin * * * *
=====================================
debian/maven.properties
=====================================
@@ -1,2 +1 @@
-maven.test.skip=true
maven.compiler.release=8
=====================================
debian/maven.rules
=====================================
@@ -1,4 +1,6 @@
junit junit jar s/4\..*/4.x/ * *
+org.junit.jupiter * jar s/.*/debian/ * *
+org.easymock * jar s/.*/debian/ * *
org.fusesource.jansi jansi jar s/.*/debian/ * *
org.apache.sshd * jar s/.*/debian/ * *
net.java.dev.jna jna jar s/.*/debian/ * *
=====================================
debian/patches/CVE-2026-56740-66662bd0.patch
=====================================
@@ -0,0 +1,294 @@
+Description: Enforce the NEW-ENVIRON variable limit across subnegotiations
+ Follow-up to CVE-2026-56740: the per-frame limit could be bypassed by
+ sending many frames. Also adds the upstream regression test.
+Author: Guillaume Nodet <gnodet at gmail.com>
+Backported-by: Juan Manuel Méndez Rey <juan.mendezr at proton.me>
+Origin: upstream, https://github.com/jline/jline3/commit/66662bd07b9f8a30540e69bc31cd850b757111bc
+Bug: https://github.com/jline/jline3/pull/2287
+Bug-Debian: https://bugs.debian.org/1143458
+Applied-Upstream: 4.4.7
+Last-Update: 2026-10-29
+
+diff --git a/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java b/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java
+index 2f2f02c..d73f379 100644
+--- a/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java
++++ b/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java
+@@ -1157,12 +1157,21 @@ public class TelnetIO {
+ return;
+ case NE_VAR_DEFINED:
+ LOG.log(Level.FINE, "readNEVariables()::NE_VAR_DEFINED");
+- if (++varCount > NE_VAR_COUNT_MAX) {
++ String str = sbuf.toString();
++ if (++varCount > NE_VAR_COUNT_MAX
++ || (TelnetIO.this
++ .connectionData
++ .getEnvironment()
++ .size()
++ >= NE_VAR_COUNT_MAX
++ && !TelnetIO.this
++ .connectionData
++ .getEnvironment()
++ .containsKey(str))) {
+ LOG.log(Level.WARNING, "readNEVariables()::TOO_MANY_VARS (>" + NE_VAR_COUNT_MAX + ")");
+ skipToSE();
+ return;
+ }
+- String str = sbuf.toString();
+ sbuf.delete(0, sbuf.length());
+ switch (readNEVariableValue(sbuf)) {
+ case NE_IN_ERROR:
+diff --git a/remote-telnet/src/test/java/org/jline/builtins/telnet/TelnetIONewEnvLimitTest.java b/remote-telnet/src/test/java/org/jline/builtins/telnet/TelnetIONewEnvLimitTest.java
+new file mode 100644
+index 0000000..397ff11
+--- /dev/null
++++ b/remote-telnet/src/test/java/org/jline/builtins/telnet/TelnetIONewEnvLimitTest.java
+@@ -0,0 +1,249 @@
++/*
++ * Copyright (c) the original author(s).
++ *
++ * This software is distributable under the BSD license. See the terms of the
++ * BSD license in the documentation provided with this software.
++ *
++ * https://opensource.org/licenses/BSD-3-Clause
++ */
++package org.jline.builtins.telnet;
++
++import java.io.ByteArrayInputStream;
++import java.io.ByteArrayOutputStream;
++import java.io.DataInputStream;
++import java.io.DataOutputStream;
++import java.io.IOException;
++import java.lang.reflect.Constructor;
++import java.lang.reflect.Field;
++import java.lang.reflect.Method;
++import java.net.InetAddress;
++import java.net.Socket;
++
++import org.junit.jupiter.api.Test;
++
++import static org.junit.jupiter.api.Assertions.assertEquals;
++import static org.junit.jupiter.api.Assertions.assertTrue;
++
++/**
++ * Regression tests for the NEW-ENVIRON variable-count limit.
++ *
++ * <p>CVE-2026-56740 introduced a per-frame {@code varCount} counter capped at
++ * {@code NE_VAR_COUNT_MAX} (100). However, the counter reset to 0 on every
++ * subnegotiation call ({@code readNEVariables()}), so an attacker could send
++ * N frames × 100 vars each and accumulate N×100 entries in the persistent
++ * environment map. The follow-up fix adds a persistent-map size check:
++ * reject new variable names when {@code env.size() >= NE_VAR_COUNT_MAX} and
++ * the name is not already in the map (updates to existing names are allowed).
++ *
++ * <p>Frame byte format (bytes consumed by {@code readNEVariables()} after the
++ * outer IAC–SB–NEWENV–IS header has been consumed by the dispatcher):
++ * <pre>
++ * NE_VAR(0) ← leading type byte consumed by readNEVariables()
++ * { name-bytes... NE_VALUE(1) ← readNEVariableName() → NE_VAR_DEFINED
++ * value-bytes... NE_VAR(0) }× N ← readNEVariableValue() → NE_VAR_OK → put(); NE_VAR consumed
++ * IAC(255) SE(240) ← readNEVariableName() sees IAC SE → NE_IN_END → return
++ * </pre>
++ * Note: the trailing IAC SE serves as a pure terminator for the loop (handled by
++ * {@code readNEVariableName()} at the start of the next iteration, not by
++ * {@code readNEVariableValue()}). Using NE_VAR to end every value ensures the
++ * variable is stored via {@code put()} before the frame ends.
++ */
++public class TelnetIONewEnvLimitTest {
++
++ // Protocol constants mirrored from TelnetIO
++ private static final int IAC = 255;
++ private static final int SE = 240;
++ private static final int NE_VAR = 0; // type byte: VAR
++ private static final int NE_VALUE = 1; // terminates a variable name → NE_VAR_DEFINED
++ private static final int NE_VAR_COUNT_MAX = 100; // matches TelnetIO.NE_VAR_COUNT_MAX
++
++ /**
++ * Builds the byte stream that {@code readNEVariables()} will consume for a frame
++ * containing {@code count} distinct variables named {@code VAR_<startIndex>} …
++ * {@code VAR_<startIndex+count-1>}, each with value {@code "v"}.
++ *
++ * <p>The stream starts with the leading {@code NE_VAR} type byte (consumed first
++ * by {@code readNEVariables()}) and ends with {@code IAC SE}.
++ */
++ private byte[] buildNeFrame(int startIndex, int count) {
++ ByteArrayOutputStream buf = new ByteArrayOutputStream();
++ // readNEVariables() reads one leading type byte before entering the loop
++ buf.write(NE_VAR);
++ for (int i = 0; i < count; i++) {
++ String name = "VAR_" + (startIndex + i);
++ // Name bytes, terminated by NE_VALUE (=1) which causes readNEVariableName()
++ // to return NE_VAR_DEFINED
++ for (byte b : name.getBytes()) {
++ buf.write(b & 0xFF);
++ }
++ buf.write(NE_VALUE);
++ // Value bytes. Each value is terminated by NE_VAR (=0), which causes
++ // readNEVariableValue() to return NE_VAR_OK and store the variable via put().
++ // The NE_VAR byte is consumed by readNEVariableValue(), so the next call to
++ // readNEVariableName() reads subsequent bytes directly.
++ buf.write('v');
++ buf.write(NE_VAR); // readNEVariableValue → NE_VAR_OK → put(), next name follows
++ }
++ // Frame terminator: after all variables are stored, readNEVariableName() is
++ // called again. It sees IAC followed by SE → returns NE_IN_END → outer loop returns.
++ buf.write(IAC);
++ buf.write(SE);
++ return buf.toByteArray();
++ }
++
++ /** Container for a test-ready {@link TelnetIO} wired to a controlled byte stream. */
++ private static final class Fixture {
++ final TelnetIO io;
++ final Object iacHandler;
++
++ @SuppressWarnings("serial")
++ Fixture(byte[] inputBytes) throws Exception {
++ // Build a minimal ConnectionData using an unconnected Socket subclass so that
++ // getInetAddress() returns a real address without actually connecting.
++ Socket loopbackSocket = new Socket() {
++ @Override
++ public InetAddress getInetAddress() {
++ return InetAddress.getLoopbackAddress();
++ }
++
++ @Override
++ public int getPort() {
++ return 0;
++ }
++
++ @Override
++ public synchronized void close() throws IOException {
++ // no-op: no real socket to close
++ }
++ };
++ ConnectionData cd = new ConnectionData(loopbackSocket, null);
++
++ // Build TelnetIO and inject connectionData + in via reflection
++ TelnetIO telnetIO = new TelnetIO();
++ setField(telnetIO, "connectionData", cd);
++ setField(telnetIO, "in", new DataInputStream(new ByteArrayInputStream(inputBytes)));
++ setField(telnetIO, "out", new DataOutputStream(new ByteArrayOutputStream()));
++
++ // Instantiate the non-static inner IACHandler (requires outer TelnetIO instance)
++ Class<?> iacClass = Class.forName("org.jline.builtins.telnet.TelnetIO$IACHandler");
++ Constructor<?> ctor = iacClass.getDeclaredConstructor(TelnetIO.class);
++ ctor.setAccessible(true);
++ Object handler = ctor.newInstance(telnetIO);
++ setField(telnetIO, "iacHandler", handler);
++
++ this.io = telnetIO;
++ this.iacHandler = handler;
++ }
++
++ /** Returns the live environment map from the ConnectionData. */
++ java.util.Map<String, String> env() throws Exception {
++ Field cdField = TelnetIO.class.getDeclaredField("connectionData");
++ cdField.setAccessible(true);
++ ConnectionData cd = (ConnectionData) cdField.get(io);
++ return cd.getEnvironment();
++ }
++
++ /** Calls {@code IACHandler.readNEVariables()} via reflection. */
++ void readNEVariables() throws Exception {
++ Method m = iacHandler.getClass().getDeclaredMethod("readNEVariables");
++ m.setAccessible(true);
++ m.invoke(iacHandler);
++ }
++
++ /** Replaces the input stream so a second frame can be fed to the same fixture. */
++ void feedFrame(byte[] bytes) throws Exception {
++ setField(io, "in", new DataInputStream(new ByteArrayInputStream(bytes)));
++ }
++ }
++
++ private static void setField(Object target, String name, Object value) throws Exception {
++ Field f = target.getClass().getDeclaredField(name);
++ f.setAccessible(true);
++ f.set(target, value);
++ }
++
++ // -------------------------------------------------------------------------
++ // Tests
++ // -------------------------------------------------------------------------
++
++ /**
++ * A single frame with exactly {@code NE_VAR_COUNT_MAX} variables must fill
++ * the environment map to the limit without overflow.
++ */
++ @Test
++ void singleFrameAtLimitFillsExactly() throws Exception {
++ Fixture f = new Fixture(buildNeFrame(0, NE_VAR_COUNT_MAX));
++ f.readNEVariables();
++ assertEquals(NE_VAR_COUNT_MAX, f.env().size(), "Environment should contain exactly NE_VAR_COUNT_MAX entries");
++ }
++
++ /**
++ * A single frame with {@code NE_VAR_COUNT_MAX + 1} variables must be truncated:
++ * the per-frame {@code varCount} guard fires on the 101st variable.
++ */
++ @Test
++ void singleFrameOverLimitTruncates() throws Exception {
++ Fixture f = new Fixture(buildNeFrame(0, NE_VAR_COUNT_MAX + 1));
++ f.readNEVariables();
++ assertTrue(
++ f.env().size() <= NE_VAR_COUNT_MAX,
++ "Environment must not exceed NE_VAR_COUNT_MAX after a single oversized frame, got: "
++ + f.env().size());
++ }
++
++ /**
++ * Multi-frame bypass regression test (the bypass of CVE-2026-56740):
++ * two consecutive frames each contributing {@code NE_VAR_COUNT_MAX} distinct
++ * variables must not accumulate beyond the limit.
++ *
++ * <p>Without the persistent-map size check, the per-frame {@code varCount} reset
++ * to 0 on each call so frame 2 could add another 100 entries to the persistent map.
++ */
++ @Test
++ void multiFrameBypassIsBlocked() throws Exception {
++ // Frame 1: fill the map to the limit
++ Fixture f = new Fixture(buildNeFrame(0, NE_VAR_COUNT_MAX));
++ f.readNEVariables();
++ assertEquals(NE_VAR_COUNT_MAX, f.env().size(), "Frame 1 should fill map to the limit");
++
++ // Frame 2: attempt to add another NE_VAR_COUNT_MAX *new*, distinct variables
++ f.feedFrame(buildNeFrame(NE_VAR_COUNT_MAX, NE_VAR_COUNT_MAX));
++ f.readNEVariables();
++
++ assertEquals(
++ NE_VAR_COUNT_MAX,
++ f.env().size(),
++ "Environment must not grow beyond NE_VAR_COUNT_MAX across multiple frames");
++ }
++
++ /**
++ * Updating an existing variable when the map is at capacity must succeed.
++ *
++ * <p>The refined guard allows {@code put()} for names already present in the map,
++ * so that a later subnegotiation can correct a previously-sent value.
++ */
++ @Test
++ void updateExistingVarAtLimitSucceeds() throws Exception {
++ // Fill to limit using VAR_0 … VAR_99
++ Fixture f = new Fixture(buildNeFrame(0, NE_VAR_COUNT_MAX));
++ f.readNEVariables();
++ assertEquals(NE_VAR_COUNT_MAX, f.env().size());
++ assertEquals("v", f.env().get("VAR_0"), "Initial value should be 'v'");
++
++ // Build a minimal frame re-sending VAR_0 with value "updated"
++ ByteArrayOutputStream buf = new ByteArrayOutputStream();
++ buf.write(NE_VAR); // leading type byte
++ for (byte b : "VAR_0".getBytes()) buf.write(b & 0xFF);
++ buf.write(NE_VALUE); // terminates name → NE_VAR_DEFINED
++ for (byte b : "updated".getBytes()) buf.write(b & 0xFF);
++ buf.write(NE_VAR); // readNEVariableValue → NE_VAR_OK → put()
++ buf.write(IAC);
++ buf.write(SE); // readNEVariableName → NE_IN_END
++
++ f.feedFrame(buf.toByteArray());
++ f.readNEVariables();
++
++ assertEquals(NE_VAR_COUNT_MAX, f.env().size(), "Map size must remain at limit after update");
++ assertEquals("updated", f.env().get("VAR_0"), "Existing variable must be updated even at the size limit");
++ }
++}
=====================================
debian/patches/CVE-2026-56740.patch
=====================================
@@ -0,0 +1,41 @@
+Description: CVE-2026-56740: cap telnet NEW-ENVIRON variables at 100
+Author: Guillaume Nodet <gnodet at gmail.com>
+Backported-by: Juan Manuel Méndez Rey <juan.mendezr at proton.me>
+Origin: upstream, https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40
+Bug: https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f
+Bug-Debian: https://bugs.debian.org/1143458
+Applied-Upstream: 3.30.14
+Last-Update: 2026-11-03
+
+diff --git a/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java b/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java
+index f75b650..2f2f02c 100644
+--- a/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java
++++ b/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java
+@@ -279,6 +279,7 @@ public class TelnetIO {
+ protected static final int NE_IN_END = -3;
+ protected static final int NE_VAR_NAME_MAXLENGTH = 50;
+ protected static final int NE_VAR_VALUE_MAXLENGTH = 1000;
++ protected static final int NE_VAR_COUNT_MAX = 100;
+ /**
+ * Unused
+ */
+@@ -1143,6 +1144,7 @@ public class TelnetIO {
+ LOG.log(Level.FINE, "readNEVariables()::INVALID VARIABLE");
+ return;
+ }
++ int varCount = 0;
+ boolean cont = true;
+ if (i == NE_VAR || i == NE_USERVAR) {
+ do {
+@@ -1155,6 +1157,11 @@ public class TelnetIO {
+ return;
+ case NE_VAR_DEFINED:
+ LOG.log(Level.FINE, "readNEVariables()::NE_VAR_DEFINED");
++ if (++varCount > NE_VAR_COUNT_MAX) {
++ LOG.log(Level.WARNING, "readNEVariables()::TOO_MANY_VARS (>" + NE_VAR_COUNT_MAX + ")");
++ skipToSE();
++ return;
++ }
+ String str = sbuf.toString();
+ sbuf.delete(0, sbuf.length());
+ switch (readNEVariableValue(sbuf)) {
=====================================
debian/patches/CVE-2026-56741.patch
=====================================
@@ -0,0 +1,34 @@
+Description: CVE-2026-56741: reset telnet NAWS sizes above 500 to the default
+Author: Guillaume Nodet <gnodet at gmail.com>
+Backported-by: Juan Manuel Méndez Rey <juan.mendezr at proton.me>
+Origin: upstream, https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40
+Bug: https://github.com/jline/jline3/security/advisories/GHSA-2r2c-cx56-8933
+Applied-Upstream: 3.30.14
+Last-Update: 2026-11-03
+
+diff --git a/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java b/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java
+index d73f379..f978f96 100644
+--- a/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java
++++ b/remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java
+@@ -297,6 +297,8 @@ public class TelnetIO {
+ private static final int SMALLEST_BELIEVABLE_HEIGHT = 6;
+ private static final int DEFAULT_WIDTH = 80;
+ private static final int DEFAULT_HEIGHT = 25;
++ private static final int LARGEST_BELIEVABLE_WIDTH = 500;
++ private static final int LARGEST_BELIEVABLE_HEIGHT = 500;
+ private Connection connection; // a reference to the connection this instance works for
+ private ConnectionData connectionData; // holds all important information of the connection
+ private DataOutputStream out; // the byte oriented outputstream
+@@ -597,10 +599,10 @@ public class TelnetIO {
+ * @param height Integer that represents the Window height in chars
+ */
+ private void setTerminalGeometry(int width, int height) {
+- if (width < SMALLEST_BELIEVABLE_WIDTH) {
++ if (width < SMALLEST_BELIEVABLE_WIDTH || width > LARGEST_BELIEVABLE_WIDTH) {
+ width = DEFAULT_WIDTH;
+ }
+- if (height < SMALLEST_BELIEVABLE_HEIGHT) {
++ if (height < SMALLEST_BELIEVABLE_HEIGHT || height > LARGEST_BELIEVABLE_HEIGHT) {
+ height = DEFAULT_HEIGHT;
+ }
+ // DEBUG: write("[New Window Size " + window_width + "x" + window_height + "]");
=====================================
debian/patches/series
=====================================
@@ -1 +1,4 @@
remove-werror.patch
+CVE-2026-56740.patch
+CVE-2026-56740-66662bd0.patch
+CVE-2026-56741.patch
=====================================
debian/rules
=====================================
@@ -29,6 +29,13 @@ override_dh_auto_build:
dh_auto_build -- -pl $(JLINE_MODULES) -am package
override_dh_auto_test:
+ # The loader needs the library we just built; /usr/lib/*/jni only holds
+ # it once the package is installed, and the pom overrides argLine.
+ # FfmTest needs a real pty, and JansiTerminalProviderTest needs the
+ # native library of jansi rather than ours.
+ LD_LIBRARY_PATH=$(CURDIR)/debian dh_auto_test -- -pl $(JLINE_MODULES) -am \
+ -Dsurefire.failIfNoSpecifiedTests=false \
+ -Dtest='!FfmTest,!JansiTerminalProviderTest#testIsSystemStream'
override_dh_auto_install:
dh_auto_install
View it on GitLab: https://salsa.debian.org/java-team/jline3/-/compare/f6d1e9bb281f15a12f0328ed89348777a2e6b897...2917d3d495633c43e3e92b599802e9d838f0fdb3
--
View it on GitLab: https://salsa.debian.org/java-team/jline3/-/compare/f6d1e9bb281f15a12f0328ed89348777a2e6b897...2917d3d495633c43e3e92b599802e9d838f0fdb3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20261103/b584e46c/attachment.htm>
More information about the pkg-java-commits
mailing list