diff options
| author |   nicm <nicm@openbsd.org> | 2020-10-29 16:33:01 +0000 |
|---|---|---|
| committer | nicm <nicm@openbsd.org> | 2020-10-29 16:33:01 +0000 |
| commit | 8b2134746b1bf1e3139cf38d48fa0ae03c96aba3 (patch) | |
| tree | 6cd8a90a8670742681431c5c9d1bae7f325e1e07 /usr.bin/tmux/input.c | |
| parent | Silence "using MMIO for ATOM IIO" error message, since that is normal on (diff) | |
| download | wireguard-openbsd-8b2134746b1bf1e3139cf38d48fa0ae03c96aba3.tar.xz wireguard-openbsd-8b2134746b1bf1e3139cf38d48fa0ae03c96aba3.zip | |
Do not write after the end of the array and overwrite the stack when
colon-separated SGR sequences contain empty arguments. Reported by Sergey
Nizovtsev.
Diffstat (limited to 'usr.bin/tmux/input.c')
| -rw-r--r-- | usr.bin/tmux/input.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/usr.bin/tmux/input.c b/usr.bin/tmux/input.c index 0110a6535d3..8f1e2f951a7 100644 --- a/usr.bin/tmux/input.c +++ b/usr.bin/tmux/input.c @@ -1,4 +1,4 @@ -/* $OpenBSD: input.c,v 1.183 2020/08/19 06:37:23 nicm Exp $ */ +/* $OpenBSD: input.c,v 1.184 2020/10/29 16:33:01 nicm Exp $ */ /* * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com> @@ -1976,8 +1976,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i) free(copy); return; } - } else + } else { n++; + if (n == nitems(p)) { + free(copy); + return; + } + } log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]); } free(copy); |