tmux: fix stack buffer overflow
This commit is contained in:
parent
0d55c5a3d3
commit
bddf0f1cb1
|
@ -0,0 +1,30 @@
|
|||
From a868bacb46e3c900530bed47a1c6f85b0fbe701c Mon Sep 17 00:00:00 2001
|
||||
From: nicm <nicm>
|
||||
Date: Thu, 29 Oct 2020 16:33:01 +0000
|
||||
Subject: [PATCH] Do not write after the end of the array and overwrite the
|
||||
stack when colon-separated SGR sequences contain empty arguments. Reported by
|
||||
Sergey Nizovtsev.
|
||||
|
||||
---
|
||||
input.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/input.c b/input.c
|
||||
index 42a60c92a..c280c0d97 100644
|
||||
--- input.c
|
||||
+++ input.c
|
||||
@@ -1976,8 +1976,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
|
||||
free(copy);
|
||||
return;
|
||||
}
|
||||
- } else
|
||||
+ } else {
|
||||
n++;
|
||||
+ if (n == nitems(p)) {
|
||||
+ free(copy);
|
||||
+ return;
|
||||
+ }
|
||||
+ }
|
||||
log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
|
||||
}
|
||||
free(copy);
|
|
@ -1,7 +1,7 @@
|
|||
# Template file for 'tmux'
|
||||
pkgname=tmux
|
||||
version=3.1b
|
||||
revision=1
|
||||
revision=2
|
||||
build_style=gnu-configure
|
||||
hostmakedepends="byacc"
|
||||
makedepends="libevent-devel ncurses-devel"
|
||||
|
|
Loading…
Reference in New Issue