d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't truncate cursor arithmetic to 16 bits.

Browse Source 
When updating the row number when the cursor position escape sequence is
issued, we should make sure to store the intermediate result in a 32-bit
integer. If we fail to do this, the cursor may be set above the origin
region, which is bad.

This could cause libteken to crash when INVARIANTS is enabled, due to
the strict set of assertions that libteken has.

PR:		202540
Reported by:	kcwu csie org
MFC after:	1 month
This commit is contained in:
Ed Schouten 2015-08-21 06:30:13 +00:00
parent 328b9e0bca
commit 9a71fa376b
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/teken/teken_subr.h
View File

@ -324,13 +324,13 @@ static void
teken_subr_cursor_position(teken_t *t, unsigned int row, unsigned int col)
{
t->t_cursor.tp_row = t->t_originreg.ts_begin + row - 1;
if (t->t_cursor.tp_row >= t->t_originreg.ts_end)
t->t_cursor.tp_row = t->t_originreg.ts_end - 1;
row = row - 1 + t->t_originreg.ts_begin;
t->t_cursor.tp_row = row < t->t_originreg.ts_end ?
row : t->t_originreg.ts_end - 1;
t->t_cursor.tp_col = col - 1;
if (t->t_cursor.tp_col >= t->t_winsize.tp_col)
t->t_cursor.tp_col = t->t_winsize.tp_col - 1;
col--;
t->t_cursor.tp_col = col < t->t_winsize.tp_col ?
col : t->t_winsize.tp_col - 1;
t->t_stateflags &= ~TS_WRAPPED;
teken_funcs_cursor(t);