From 98ce2f265f986fb88c38d508286bb5e3716b9e74 Mon Sep 17 00:00:00 2001
From: Christian Persch <chpe@gnome.org>
Date: Sat, 19 May 2012 18:04:12 +0000
Subject: emulation: Limit repetitions

Don't allow malicious sequences to cause excessive repetitions.

https://bugzilla.gnome.org/show_bug.cgi?id=676090
---
diff --git a/src/vteseq.c b/src/vteseq.c
index 46def5b..7fb4707 100644
--- a/src/vteseq.c
+++ b/src/vteseq.c
@@ -1397,7 +1397,7 @@ vte_sequence_handler_dc (VteTerminal *terminal, GValueArray *params)
 static void
 vte_sequence_handler_DC (VteTerminal *terminal, GValueArray *params)
 {
-	vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_dc);
+	vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_dc);
 }
 
 /* Delete a line at the current cursor position. */
@@ -1790,7 +1790,7 @@ vte_sequence_handler_reverse_index (VteTerminal *terminal, GValueArray *params)
 static void
 vte_sequence_handler_RI (VteTerminal *terminal, GValueArray *params)
 {
-	vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_nd);
+	vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_nd);
 }
 
 /* Save cursor (position). */
@@ -2782,8 +2782,7 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
 {
 	GValue *value;
 	VteScreen *screen;
-	long param, end, row;
-	int i;
+	long param, end, row, i, limit;
 	screen = terminal->pvt->screen;
 	/* The default is one. */
 	param = 1;
@@ -2801,7 +2800,13 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)
 	} else {
 		end = screen->insert_delta + terminal->row_count - 1;
 	}
-	/* Insert the new lines at the cursor. */
+
+	/* Only allow to insert as many lines as there are between this row
+         * and the end of the scrolling region. See bug #676090.
+         */
+        limit = end - row + 1;
+        param = MIN (param, limit);
+
 	for (i = 0; i < param; i++) {
 		/* Clear a line off the end of the region and add one to the
 		 * top of the region. */
@@ -2822,8 +2827,7 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
 {
 	GValue *value;
 	VteScreen *screen;
-	long param, end, row;
-	int i;
+	long param, end, row, i, limit;
 
 	screen = terminal->pvt->screen;
 	/* The default is one. */
@@ -2842,6 +2846,13 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)
 	} else {
 		end = screen->insert_delta + terminal->row_count - 1;
 	}
+
+        /* Only allow to delete as many lines as there are between this row
+         * and the end of the scrolling region. See bug #676090.
+         */
+        limit = end - row + 1;
+        param = MIN (param, limit);
+
 	/* Clear them from below the current cursor. */
 	for (i = 0; i < param; i++) {
 		/* Insert a line at the end of the region and remove one from
--
cgit v0.9.0.2
ue='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Ricardo Wurmus &lt;rekado@elephly.net&gt;</td><td class='right'>2020-01-27 16:31:51 +0100</td></tr>
<tr><th>committer</th><td>Ricardo Wurmus &lt;rekado@elephly.net&gt;</td><td class='right'>2020-01-27 16:33:30 +0100</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/guix/commit/?id=af837b99642ddaf20f011821345ad6fc0c1c9137'>af837b99642ddaf20f011821345ad6fc0c1c9137</a> (<a href='/guix/patch/?id=af837b99642ddaf20f011821345ad6fc0c1c9137'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/guix/tree/?id=af837b99642ddaf20f011821345ad6fc0c1c9137'>b79cad271d60ce8b589759a3146bceabbf0e4c59</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/guix/commit/?id=8d9e85221f010a2e73025edfd9528650299cc53a'>8d9e85221f010a2e73025edfd9528650299cc53a</a> (<a href='/guix/diff/?id=af837b99642ddaf20f011821345ad6fc0c1c9137&amp;id2=8d9e85221f010a2e73025edfd9528650299cc53a'>diff</a>)</td></tr><tr><th>download</th><td colspan='2' class='oid'><a href='/guix/snapshot/guix-af837b99642ddaf20f011821345ad6fc0c1c9137.tar.gz'>guix-af837b99642ddaf20f011821345ad6fc0c1c9137.tar.gz</a><br/><a href='/guix/snapshot/guix-af837b99642ddaf20f011821345ad6fc0c1c9137.zip'>guix-af837b99642ddaf20f011821345ad6fc0c1c9137.zip</a><br/></td></tr></table>
<div class='commit-subject'>gnu: r-rmarkdown: Update to 2.1.</div><div class='commit-msg'>* gnu/packages/statistics.scm (r-rmarkdown): Update to 2.1.
</div><div class='diffstat-header'><a href='/guix/diff/?id=af837b99642ddaf20f011821345ad6fc0c1c9137'>Diffstat</a></div><table summary='diffstat' class='diffstat'>