Skip to content

Commit a6d5778

Browse files
julio-bchrisbra
authored andcommitted
patch 9.1.1082: unexpected DCS responses may cause out of bounds reads
Problem: unexpected DCS responses may cause out of bounds reads (after v9.1.1054) Solution: check that the parsed value is '=' as expected (Julio B) Signed-off-by: Julio B <[email protected]> Signed-off-by: Christian Brabandt <[email protected]>
1 parent a41dfcd commit a6d5778

File tree

2 files changed

+7
-2
lines changed

2 files changed

+7
-2
lines changed

src/term.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7136,7 +7136,9 @@ req_more_codes_from_term(void)
71367136
}
71377137

71387138
/*
7139-
* Decode key code response from xterm: '<Esc>P1+r<name>=<string><Esc>\'.
7139+
* Decode key code response from xterm:
7140+
* '<Esc>P1+r<name>=<string><Esc>\' if it is enabled/supported
7141+
* '<Esc>P0+r<Esc>\' if it not enabled
71407142
* A "0" instead of the "1" indicates a code that isn't supported.
71417143
* Both <name> and <string> are encoded in hex.
71427144
* "code" points to the "0" or "1".
@@ -7152,8 +7154,9 @@ got_code_from_term(char_u *code, int len)
71527154
int c;
71537155

71547156
// A '1' means the code is supported, a '0' means it isn't.
7157+
// If it is supported, there must be a '=' following
71557158
// When half the length is > XT_LEN we can't use it.
7156-
if (code[0] == '1' && (code[7] || code[9] == '=') && len / 2 < XT_LEN)
7159+
if (code[0] == '1' && (code[7] == '=' || code[9] == '=') && len / 2 < XT_LEN)
71577160
{
71587161
// Get the name from the response and find it in the table.
71597162
name[0] = hexhex2nr(code + 3);

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -704,6 +704,8 @@ static char *(features[]) =
704704

705705
static int included_patches[] =
706706
{ /* Add new patch number below this line */
707+
/**/
708+
1082,
707709
/**/
708710
1081,
709711
/**/

0 commit comments

Comments
 (0)