This patch prevents a code execution vector involving terminal escape
sequences when rxvt-unicode is in "secure mode".

This change was spurred by the following conversation on the
oss-security mailing list:

Problem description and proof of concept:
http://seclists.org/oss-sec/2017/q2/190

Upstream response:
http://seclists.org/oss-sec/2017/q2/291

Patch copied from upstream source repository:
http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583

--- rxvt-unicode/src/command.C	2016/07/14 05:33:26	1.582
+++ rxvt-unicode/src/command.C	2017/05/18 02:43:18	1.583
@@ -2695,7 +2695,7 @@
         /* kidnapped escape sequence: Should be 8.3.48 */
       case C1_ESA:		/* ESC G */
         // used by original rxvt for rob nations own graphics mode
-        if (cmd_getc () == 'Q')
+        if (cmd_getc () == 'Q' && option (Opt_insecure))
           tt_printf ("\033G0\012");	/* query graphics - no graphics */
         break;
 
@@ -2914,7 +2914,7 @@
         break;
 
       case CSI_CUB:		/* 8.3.18: (1) CURSOR LEFT */
-      case CSI_HPB: 		/* 8.3.59: (1) CHARACTER POSITION BACKWARD */
+      case CSI_HPB:		/* 8.3.59: (1) CHARACTER POSITION BACKWARD */
 #ifdef ISO6429
         arg[0] = -arg[0];
 #else				/* emulate common DEC VTs */
9495a2f1c5bd13b0566fa7e0ef0cf0'>tree</a><a href='/guix/commit/nix/libutil/hash.hh?id=7b2e4ccce29495a2f1c5bd13b0566fa7e0ef0cf0'>commit</a><a href='/guix/diff/nix/libutil/hash.hh?id=7b2e4ccce29495a2f1c5bd13b0566fa7e0ef0cf0'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/nix/libutil/hash.hh'>
<input type='hidden' name='id' value='7b2e4ccce29495a2f1c5bd13b0566fa7e0ef0cf0'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=7b2e4ccce29495a2f1c5bd13b0566fa7e0ef0cf0'>root</a>/<a href='/guix/log/nix?id=7b2e4ccce29495a2f1c5bd13b0566fa7e0ef0cf0'>nix</a>/<a href='/guix/log/nix/libutil?id=7b2e4ccce29495a2f1c5bd13b0566fa7e0ef0cf0'>libutil</a>/<a href='/guix/log/nix/libutil/hash.hh?id=7b2e4ccce29495a2f1c5bd13b0566fa7e0ef0cf0'>hash.hh</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/nix/libutil/hash.hh?id=7b2e4ccce29495a2f1c5bd13b0566fa7e0ef0cf0&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>