diff options
| author |   nicm <nicm@openbsd.org> | 2015-08-25 15:00:05 +0000 |
|---|---|---|
| committer | nicm <nicm@openbsd.org> | 2015-08-25 15:00:05 +0000 |
| commit | dfeb6f4803e48aaa73af21eb7e84a30d44fe83c6 (patch) | |
| tree | 66742f27275fc1bff53637806b1091bd065a352c | |
| parent | Put the device name into the timeout message. OK jsg@ (diff) | |
| download | wireguard-openbsd-dfeb6f4803e48aaa73af21eb7e84a30d44fe83c6.tar.xz wireguard-openbsd-dfeb6f4803e48aaa73af21eb7e84a30d44fe83c6.zip | |
When searching for tabs, start from screen width, fixes out-of-bounds
read found by Kuang-che Wu.
| -rw-r--r-- | usr.bin/tmux/input.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/usr.bin/tmux/input.c b/usr.bin/tmux/input.c index 39f85c632a0..270a7228a1e 100644 --- a/usr.bin/tmux/input.c +++ b/usr.bin/tmux/input.c @@ -1,4 +1,4 @@ -/* $OpenBSD: input.c,v 1.80 2015/07/13 18:45:18 nicm Exp $ */ +/* $OpenBSD: input.c,v 1.81 2015/08/25 15:00:05 nicm Exp $ */ /* * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net> @@ -1199,6 +1199,7 @@ input_csi_dispatch(struct input_ctx *ictx) struct screen *s = sctx->s; struct input_table_entry *entry; int n, m; + u_int cx; if (ictx->flags & INPUT_DISCARD) return (0); @@ -1217,12 +1218,16 @@ input_csi_dispatch(struct input_ctx *ictx) switch (entry->type) { case INPUT_CSI_CBT: /* Find the previous tab point, n times. */ + cx = s->cx; + if (cx > screen_size_x(s) - 1) + cx = screen_size_x(s) - 1; n = input_get(ictx, 0, 1, 1); - while (s->cx > 0 && n-- > 0) { + while (cx > 0 && n-- > 0) { do - s->cx--; - while (s->cx > 0 && !bit_test(s->tabs, s->cx)); + cx--; + while (cx > 0 && !bit_test(s->tabs, cx)); } + s->cx = cx; break; case INPUT_CSI_CUB: screen_write_cursorleft(sctx, input_get(ictx, 0, 1, 1)); |