aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-08-31 20:53:42 -04:00
Code

patch 9.1.1082: unexpected DCS responses may cause out of bounds reads

Browse Source 
Problem:  unexpected DCS responses may cause out of bounds reads
          (after v9.1.1054)
Solution: check that the parsed value is '=' as expected
          (Julio B)

Signed-off-by: Julio B <julio.bacel@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Julio B 2025-02-07 20:44:49 +01:00 committed by Christian Brabandt
parent a41dfcd55b
commit a6d5778d9b
No known key found for this signature in database
GPG Key ID: F3F92DA383FDDE09
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/term.c
View File

@ -7136,7 +7136,9 @@ req_more_codes_from_term(void)
}
/*
* Decode key code response from xterm: '<Esc>P1+r<name>=<string><Esc>\'.
* Decode key code response from xterm:
* '<Esc>P1+r<name>=<string><Esc>\' if it is enabled/supported
* '<Esc>P0+r<Esc>\' if it not enabled
* A "0" instead of the "1" indicates a code that isn't supported.
* Both <name> and <string> are encoded in hex.
* "code" points to the "0" or "1".
@ -7152,8 +7154,9 @@ got_code_from_term(char_u *code, int len)
int c;
// A '1' means the code is supported, a '0' means it isn't.
// If it is supported, there must be a '=' following
// When half the length is > XT_LEN we can't use it.
if (code[0] == '1' && (code[7] || code[9] == '=') && len / 2 < XT_LEN)
if (code[0] == '1' && (code[7] == '=' || code[9] == '=') && len / 2 < XT_LEN)
{
// Get the name from the response and find it in the table.
name[0] = hexhex2nr(code + 3);

2
src/version.c
View File

@ -704,6 +704,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
1082,
/**/
1081,
/**/