mirrors/foot
1
0
Fork 0
mirror of https://codeberg.org/dnkl/foot.git synced 2026-04-06 07:15:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

csi: clamp color index for ‘CSI 38/48 ; 5 ; idx m’ sequences

Browse source 
Indexed color values are stored in the cell attributes as color
indices (into the 256-color table). However, the index from the CSI
was not validated in any way, meaning you can do something like this:

  echo -e ‘\e[38:5:1024m CRASH \e[m’

and foot will crash on an out-of-bounds access.

Fix by clamping the color index.

Closes #1111
This commit is contained in:
Daniel Eklöf 2022-07-22 10:44:33 +02:00
parent 0c60bb3f29
commit 87e4004960
No known key found for this signature in database
GPG key ID: 5BBD4992C116573F
2 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGELOG.md
View file

@ -82,10 +82,14 @@
support the offered mime-types ([#1092][1092]). support the offered mime-types ([#1092][1092]).
* Keyboard enter/leave events being ignored if there is no keymap * Keyboard enter/leave events being ignored if there is no keymap
([#1097][1097]). ([#1097][1097]).
* Crash when application emitted an invalid `CSI 38;5;<idx>m`, `CSI
38:5:<idx>m`, `CSI 48;5;<idx>m` or `CSI 48:5:<idx>m` sequence
([#1111][1111]).
[1055]: https://codeberg.org/dnkl/foot/issues/1055 [1055]: https://codeberg.org/dnkl/foot/issues/1055
[1092]: https://codeberg.org/dnkl/foot/issues/1092 [1092]: https://codeberg.org/dnkl/foot/issues/1092
[1097]: https://codeberg.org/dnkl/foot/issues/1097 [1097]: https://codeberg.org/dnkl/foot/issues/1097
[1111]: https://codeberg.org/dnkl/foot/issues/1111
### Security ### Security

6
csi.c
View file

@ -128,7 +128,8 @@ csi_sgr(struct terminal *term)
term->vt.params.v[i + 1].value == 5) term->vt.params.v[i + 1].value == 5)
{ {
src = COLOR_BASE256; src = COLOR_BASE256;
color = term->vt.params.v[i + 2].value; color = min(term->vt.params.v[i + 2].value,
ALEN(term->colors.table) - 1);
i += 2; i += 2;
} }
@ -149,7 +150,8 @@ csi_sgr(struct terminal *term)
term->vt.params.v[i].sub.value[0] == 5) term->vt.params.v[i].sub.value[0] == 5)
{ {
src = COLOR_BASE256; src = COLOR_BASE256;
color = term->vt.params.v[i].sub.value[1]; color = min(term->vt.params.v[i].sub.value[1],
ALEN(term->colors.table) - 1);
} }
/* /*