diff options
| author | Nicholas Marriott <nicm@cvs.openbsd.org> | 2020-10-29 16:33:02 +0000 |
|---|---|---|
| committer | Nicholas Marriott <nicm@cvs.openbsd.org> | 2020-10-29 16:33:02 +0000 |
| commit | bf7c064c0faba1cb4cf202663658c706080f3372 (patch) | |
| tree | 8d8497ec60e12c8827d393a09a2b55d07d8fde1e /usr.bin/tmux | |
| parent | 30efc3babd3e390939a5dc39cca4e6995f7a9125 (diff) | |
Do not write after the end of the array and overwrite the stack when
colon-separated SGR sequences contain empty arguments. Reported by Sergey
Nizovtsev.
Diffstat (limited to 'usr.bin/tmux')
| -rw-r--r-- | usr.bin/tmux/input.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/usr.bin/tmux/input.c b/usr.bin/tmux/input.c index 0110a6535d3..8f1e2f951a7 100644 --- a/usr.bin/tmux/input.c +++ b/usr.bin/tmux/input.c @@ -1,4 +1,4 @@ -/* $OpenBSD: input.c,v 1.183 2020/08/19 06:37:23 nicm Exp $ */ +/* $OpenBSD: input.c,v 1.184 2020/10/29 16:33:01 nicm Exp $ */ /* * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com> @@ -1976,8 +1976,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i) free(copy); return; } - } else + } else { n++; + if (n == nitems(p)) { + free(copy); + return; + } + } log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]); } free(copy); |