From e24ad0a793819b12929fadba53725cf5ec3826ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Ekl=C3=B6f?= <daniel@ekloef.se>
Date: Wed, 24 Jun 2026 13:06:16 +0200
Subject: [PATCH] csi: clamp REP count to scrollback-lines * cols

This can be quite a lot, but hopefully less than 0x7fffffff, which is
the max value a VT parameter can have...

Closes #2366
---
 csi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/csi.c b/csi.c
index ed643090..68825760 100644
--- a/csi.c
+++ b/csi.c
@@ -798,7 +798,8 @@ csi_dispatch(struct terminal *term, uint8_t final)
                  * ECMA-48, the behaviour is undefined if REP was
                  * _not_ preceded by a graphical character.
                  */
-                int count = vt_param_get(term, 0, 1);
+                const size_t max_count = term->grid->num_rows * term->cols;
+                int count = min(vt_param_get(term, 0, 1), max_count);
                 LOG_DBG("REP: '%lc' %d times", (wint_t)term->vt.last_printed, count);
 
                 int width;