diff options
| author | Amadeusz Sławiński <amade@asmblr.net> | 2020-01-30 17:56:27 +0100 |
|---|---|---|
| committer | Amadeusz Sławiński <amade@asmblr.net> | 2020-02-05 21:00:42 +0100 |
| commit | eb2be1adf92d58bd8f4ca3458eb04da38bf33c2b (patch) | |
| tree | de95bff5f4d75ae07b8dbf24612a136bf806ab07 | |
| parent | eb38c84a676a5e6a8d628fa7584ed5c78405de06 (diff) | |
| download | screen-eb2be1adf92d58bd8f4ca3458eb04da38bf33c2b.tar.gz | |
Fix out of bounds access when setting w_xtermosc after OSC 49
echo -e "\e]49\e; \n\ec"
crashes screen.
This happens because 49 is divided by 10 and used as table index
resulting in access to w_xtermosc[4], which is out of bounds with table
itself being size 4. Increase size of table by 1 to 5, which is enough
for all current uses.
As this overwrites memory based on user input it is potential security
issue.
Reported-by: pippin@gimp.org
Signed-off-by: Amadeusz Sławiński <amade@asmblr.net>
| -rw-r--r-- | src/window.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/window.h b/src/window.h index ce2510f..81ae294 100644 --- a/src/window.h +++ b/src/window.h @@ -222,7 +222,7 @@ struct Window { int w_silencewait; /* wait for silencewait secs */ int w_silence; /* silence status (Lloyd Zusman) */ char w_norefresh; /* dont redisplay when switching to that win */ - char w_xtermosc[4][MAXSTR]; /* special xterm/rxvt escapes */ + char w_xtermosc[5][MAXSTR]; /* special xterm/rxvt escapes */ int w_mouse; /* mouse mode 0,9,1000 */ int w_extmouse; /* extended mouse mode 0,1006 */ bool w_bracketed; /* bracketed paste mode */ |