From 98ce2f265f986fb88c38d508286bb5e3716b9e74 Mon Sep 17 00:00:00 2001
From: Christian Persch <chpe@gnome.org>
Date: Sat, 19 May 2012 18:04:12 +0000
Subject: emulation: Limit repetitions

Don't allow malicious sequences to cause excessive repetitions.

https://bugzilla.gnome.org/show_bug.cgi?id=676090
---
diff --git a/src/vteseq.c b/src/vteseq.c
index 46def5b..7fb4707 100644
--- a/src/vteseq.c
+++ b/src/vteseq.c
@@ -1397,7 +1397,7 @@ vte_sequence_handler_dc (VteTerminal *terminal, GValueArray *params)
 static void
 vte_sequence_handler_DC (VteTerminal *terminal, GValueArray *params)
 {
-	vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_dc);
+	vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_dc);
 }
 
 /* Delete a line at the current cursor position. */
@@ -1790,7 +1790,7 @@ vte_sequence_handler_reverse_index (VteTerminal *terminal, GValueArray *params)
 static void
 vte_sequence_handler_RI (VteTerminal *terminal, GValueArray *params)
 {
-	vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_nd);
+	vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_nd);
 }
 
 /* Save cursor (position). */
@@ -2782,8 +2782,7 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
 {
 	GValue *value;
 	VteScreen *screen;
-	long param, end, row;
-	int i;
+	long param, end, row, i, limit;
 	screen = terminal->pvt->screen;
 	/* The default is one. */
 	param = 1;
@@ -2801,7 +2800,13 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
 	} else {
 		end = screen->insert_delta + terminal->row_count - 1;
 	}
-	/* Insert the new lines at the cursor. */
+
+	/* Only allow to insert as many lines as there are between this row
+         * and the end of the scrolling region. See bug #676090.
+         */
+        limit = end - row + 1;
+        param = MIN (param, limit);
+
 	for (i = 0; i < param; i++) {
 		/* Clear a line off the end of the region and add one to the
 		 * top of the region. */
@@ -2822,8 +2827,7 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
 {
 	GValue *value;
 	VteScreen *screen;
-	long param, end, row;
-	int i;
+	long param, end, row, i, limit;
 
 	screen = terminal->pvt->screen;
 	/* The default is one. */
@@ -2842,6 +2846,13 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
 	} else {
 		end = screen->insert_delta + terminal->row_count - 1;
 	}
+
+        /* Only allow to delete as many lines as there are between this row
+         * and the end of the scrolling region. See bug #676090.
+         */
+        limit = end - row + 1;
+        param = MIN (param, limit);
+
 	/* Clear them from below the current cursor. */
 	for (i = 0; i < param; i++) {
 		/* Insert a line at the end of the region and remove one from
--
cgit v0.9.0.2
-04-18 10:43:06 -0400'>2024-04-18</span></td><td><a href='/guix/commit/gnu/system/examples/desktop.tmpl?id=65e8472a4b6fc6f66871ba0dad518b7d4c63595e'>system: Remove nss-certs from OS templates, adjust doc.</a><span class='msg-avail'>...<span class='msg-tooltip'>This is a follow-up to commit 86afaadb51 ("system: Add 'nss-certs' to
%base-packages-networking.")

* doc/guix-cookbook.texi (Running Guix on a Linode Server): Remove nss-certs
from operating system's packages field.
(Running Guix on a Kimsufi Server): Likewise.
* doc/guix.texi (Using the Configuration System): Likewise.
(X.509 Certificates): Adjust to mention nss-certs *is* part of %base-packages.
* gnu/installer/services.scm (%system-services): Remove recommendation to
install nss-certs.
* gnu/system/examples/bare-bones.tmpl (host-name): Remove obsolete comments.
* gnu/system/examples/desktop.tmpl (packages): Remove nss-certs.
* gnu/system/examples/lightweight-desktop.tmpl (packages): Likewise.
* gnu/system/examples/plasma.tmpl (packages): Likewise.
* gnu/system/examples/raspberry-pi-64-nfs-root.tmpl (packages): Likewise.
* gnu/system/examples/raspberry-pi-64.tmpl (packages): Likewise.
* gnu/system/examples/vm-image.tmpl (packages): Likewise.
* gnu/system/images/orangepi-r1-plus-lts-rk3328.scm (packages): Likewise.
* gnu/system/images/pine64.scm (packages): Likewise.
* gnu/system/install.scm (installation-os) [packages]: Likewise.

Change-Id: If09123a69b987178bcb0aab61c4570c14fc1286f
</span></span></td><td>Maxim Cournoyer</td></tr>