tmux: fix stack buffer overflow

This commit is contained in:
Duncaen 2020-10-29 22:56:11 +01:00
parent 0d55c5a3d3
commit bddf0f1cb1
No known key found for this signature in database
GPG key ID: 335C1D17EC3D6E35
2 changed files with 31 additions and 1 deletions

View file

@ -0,0 +1,30 @@
From a868bacb46e3c900530bed47a1c6f85b0fbe701c Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Thu, 29 Oct 2020 16:33:01 +0000
Subject: [PATCH] Do not write after the end of the array and overwrite the
stack when colon-separated SGR sequences contain empty arguments. Reported by
Sergey Nizovtsev.
---
input.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/input.c b/input.c
index 42a60c92a..c280c0d97 100644
--- input.c
+++ input.c
@@ -1976,8 +1976,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
free(copy);
return;
}
- } else
+ } else {
n++;
+ if (n == nitems(p)) {
+ free(copy);
+ return;
+ }
+ }
log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
}
free(copy);

View file

@ -1,7 +1,7 @@
# Template file for 'tmux'
pkgname=tmux
version=3.1b
revision=1
revision=2
build_style=gnu-configure
hostmakedepends="byacc"
makedepends="libevent-devel ncurses-devel"