From 98ce2f265f986fb88c38d508286bb5e3716b9e74 Mon Sep 17 00:00:00 2001
From: Christian Persch <chpe@gnome.org>
Date: Sat, 19 May 2012 18:04:12 +0000
Subject: emulation: Limit repetitions

Don't allow malicious sequences to cause excessive repetitions.

https://bugzilla.gnome.org/show_bug.cgi?id=676090
---
diff --git a/src/vteseq.c b/src/vteseq.c
index 46def5b..7fb4707 100644
--- a/src/vteseq.c
+++ b/src/vteseq.c
@@ -1397,7 +1397,7 @@ vte_sequence_handler_dc (VteTerminal *terminal, GValueArray *params)
 static void
 vte_sequence_handler_DC (VteTerminal *terminal, GValueArray *params)
 {
-	vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_dc);
+	vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_dc);
 }
 
 /* Delete a line at the current cursor position. */
@@ -1790,7 +1790,7 @@ vte_sequence_handler_reverse_index (VteTerminal *terminal, GValueArray *params)
 static void
 vte_sequence_handler_RI (VteTerminal *terminal, GValueArray *params)
 {
-	vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_nd);
+	vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_nd);
 }
 
 /* Save cursor (position). */
@@ -2782,8 +2782,7 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
 {
 	GValue *value;
 	VteScreen *screen;
-	long param, end, row;
-	int i;
+	long param, end, row, i, limit;
 	screen = terminal->pvt->screen;
 	/* The default is one. */
 	param = 1;
@@ -2801,7 +2800,13 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
 	} else {
 		end = screen->insert_delta + terminal->row_count - 1;
 	}
-	/* Insert the new lines at the cursor. */
+
+	/* Only allow to insert as many lines as there are between this row
+         * and the end of the scrolling region. See bug #676090.
+         */
+        limit = end - row + 1;
+        param = MIN (param, limit);
+
 	for (i = 0; i < param; i++) {
 		/* Clear a line off the end of the region and add one to the
 		 * top of the region. */
@@ -2822,8 +2827,7 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
 {
 	GValue *value;
 	VteScreen *screen;
-	long param, end, row;
-	int i;
+	long param, end, row, i, limit;
 
 	screen = terminal->pvt->screen;
 	/* The default is one. */
@@ -2842,6 +2846,13 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
 	} else {
 		end = screen->insert_delta + terminal->row_count - 1;
 	}
+
+        /* Only allow to delete as many lines as there are between this row
+         * and the end of the scrolling region. See bug #676090.
+         */
+        limit = end - row + 1;
+        param = MIN (param, limit);
+
 	/* Clear them from below the current cursor. */
 	for (i = 0; i < param; i++) {
 		/* Insert a line at the end of the region and remove one from
--
cgit v0.9.0.2
u/bootloader?id=f126f23b132148192b2c9a89032a5831af0b3c52'>bootloader: Add device-tree-support? option.</a><span class='msg-avail'>...</span></td><td>Reza Alizadeh Majd</td></tr>
<tr><td><span title='2022-06-24 10:21:06 +0200'>2022-06-24</span></td><td><a href='/guix/commit/gnu/bootloader?id=62c86c8391ceb8953ca972498fd75ea9298b85ff'>image: Add support for 32bit UEFI.</a><span class='msg-avail'>...</span></td><td>Denis 'GNUtoo' Carikli</td></tr>
<tr><td><span title='2022-06-06 22:43:30 +0200'>2022-06-06</span></td><td><a href='/guix/commit/gnu/bootloader?id=618f665a5ffc6330bc99c4ac2b1077c1e1a7506c'>bootloader: grub: Add removable grub-efi bootloader option.</a><span class='msg-avail'>...</span></td><td>Karl Hallsby</td></tr>
<tr><td><span title='2022-01-13 11:11:02 +0100'>2022-01-13</span></td><td><a href='/guix/commit/gnu/bootloader?id=ea71ec1630e06503c14c6e7f4570b69de4e42123'>bootloader: grub: Fix serial mode.</a><span class='msg-avail'>...</span></td><td>Mathieu Othacehe</td></tr>
<tr><td><span title='2021-12-01 17:51:37 +0100'>2021-12-01</span></td><td><a href='/guix/commit/gnu/bootloader?id=adce91a3ec0cb2912daa6eefe9324c15ff3126f7'>gnu: system: Add LUKS2 support for the root file system.</a><span class='msg-avail'>...</span></td><td>Josselin Poiret</td></tr>