This patch prevents a code execution vector involving terminal escape
sequences when rxvt-unicode is in "secure mode".

This change was spurred by the following conversation on the
oss-security mailing list:

Problem description and proof of concept:
http://seclists.org/oss-sec/2017/q2/190

Upstream response:
http://seclists.org/oss-sec/2017/q2/291

Patch copied from upstream source repository:
http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583

--- rxvt-unicode/src/command.C	2016/07/14 05:33:26	1.582
+++ rxvt-unicode/src/command.C	2017/05/18 02:43:18	1.583
@@ -2695,7 +2695,7 @@
         /* kidnapped escape sequence: Should be 8.3.48 */
       case C1_ESA:		/* ESC G */
         // used by original rxvt for rob nations own graphics mode
-        if (cmd_getc () == 'Q')
+        if (cmd_getc () == 'Q' && option (Opt_insecure))
           tt_printf ("\033G0\012");	/* query graphics - no graphics */
         break;
 
@@ -2914,7 +2914,7 @@
         break;
 
       case CSI_CUB:		/* 8.3.18: (1) CURSOR LEFT */
-      case CSI_HPB: 		/* 8.3.59: (1) CHARACTER POSITION BACKWARD */
+      case CSI_HPB:		/* 8.3.59: (1) CHARACTER POSITION BACKWARD */
 #ifdef ISO6429
         arg[0] = -arg[0];
 #else				/* emulate common DEC VTs */
</a><a href='/guix/commit/m4/guix.m4?id=23aa12fc092c69228c6a636897f17c535605b35e'>commit</a><a href='/guix/diff/m4/guix.m4?id=23aa12fc092c69228c6a636897f17c535605b35e'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/m4/guix.m4'>
<input type='hidden' name='id' value='23aa12fc092c69228c6a636897f17c535605b35e'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=23aa12fc092c69228c6a636897f17c535605b35e'>root</a>/<a href='/guix/log/m4?id=23aa12fc092c69228c6a636897f17c535605b35e'>m4</a>/<a href='/guix/log/m4/guix.m4?id=23aa12fc092c69228c6a636897f17c535605b35e'>guix.m4</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/m4/guix.m4?id=23aa12fc092c69228c6a636897f17c535605b35e&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2018-09-04 17:25:11 +0200'>2018-09-04</span></td><td><a href='/guix/commit/m4/guix.m4?id=ca719424455465fca4b872c371daf2a46de88b33'>Switch to Guile-Gcrypt.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-06-01 15:35:15 +0200'>2018-06-01</span></td><td><a href='/guix/commit/m4/guix.m4?id=d59e75f3b5b82692bd250a1a3a9965397bb588c5'>build: Check for Guile-SQLite3.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>