From 98ce2f265f986fb88c38d508286bb5e3716b9e74 Mon Sep 17 00:00:00 2001 From: Christian Persch Date: Sat, 19 May 2012 18:04:12 +0000 Subject: emulation: Limit repetitions Don't allow malicious sequences to cause excessive repetitions. https://bugzilla.gnome.org/show_bug.cgi?id=676090 --- diff --git a/src/vteseq.c b/src/vteseq.c index 46def5b..7fb4707 100644 --- a/src/vteseq.c +++ b/src/vteseq.c @@ -1397,7 +1397,7 @@ vte_sequence_handler_dc (VteTerminal *terminal, GValueArray *params) static void vte_sequence_handler_DC (VteTerminal *terminal, GValueArray *params) { - vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_dc); + vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_dc); } /* Delete a line at the current cursor position. */ @@ -1790,7 +1790,7 @@ vte_sequence_handler_reverse_index (VteTerminal *terminal, GValueArray *params) static void vte_sequence_handler_RI (VteTerminal *terminal, GValueArray *params) { - vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_nd); + vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_nd); } /* Save cursor (position). */ @@ -2782,8 +2782,7 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params) { GValue *value; VteScreen *screen; - long param, end, row; - int i; + long param, end, row, i, limit; screen = terminal->pvt->screen; /* The default is one. */ param = 1; @@ -2801,7 +2800,13 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params) } else { end = screen->insert_delta + terminal->row_count - 1; } - /* Insert the new lines at the cursor. */ + + /* Only allow to insert as many lines as there are between this row + * and the end of the scrolling region. See bug #676090. + */ + limit = end - row + 1; + param = MIN (param, limit); + for (i = 0; i < param; i++) { /* Clear a line off the end of the region and add one to the * top of the region. */ @@ -2822,8 +2827,7 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params) { GValue *value; VteScreen *screen; - long param, end, row; - int i; + long param, end, row, i, limit; screen = terminal->pvt->screen; /* The default is one. */ @@ -2842,6 +2846,13 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params) } else { end = screen->insert_delta + terminal->row_count - 1; } + + /* Only allow to delete as many lines as there are between this row + * and the end of the scrolling region. See bug #676090. + */ + limit = end - row + 1; + param = MIN (param, limit); + /* Clear them from below the current cursor. */ for (i = 0; i < param; i++) { /* Insert a line at the end of the region and remove one from -- cgit v0.9.0.2 regression was introduce with commit a274a6a1acb99738f02de7b226e6a0d3883ec353 ("upstream-updater: Rename record field.") * tests/tests/gnu-maintenance.scm: ("latest-html-release, scheme-less URIs", "latest-html-release, no signature", "latest-html-release, signature"): Replace upstream-updater-latest by upstream-updater-import. Reported-by: Ricardo Wurmus <rekado@elephly.net> Hartmut Goebel 2022-11-11gnu-maintenance: 'release-file?' excludes "valgrind-3.20.0.RC1.tar.bz2"....* guix/gnu-maintenance.scm (%alpha-tarball-rx): Add "." before "(alpha|beta|...)". * tests/gnu-maintenance.scm ("release-file?"): Add test for Valgrind. Ludovic Courtès 2022-09-26gnu-maintenance: Test latest-html-release....* tests/gnu-maintenance.scm ("latest-html-release, no signature") ("latest-html-release, signature): New tests. Signed-off-by: Ludovic Courtès <ludo@gnu.org> Maxime Devos 2022-09-17gnu-maintenance: Support // URLs in latest-html-release....This makes "./pre-inst-env guix refresh -u" download the release tarball from the right place -- previously, it downloaded from https://www.libreoffice.org//download.documentfoundation.org/libreoffice/src/7.4.0/libreoffice-7.4.0.3.tar.xz?idx=1 whereas it should download from https://download.documentfoundation.org/libreoffice/src/7.4.0/libreoffice-7.4.0.3.tar.xz?idx=1 instead. * guix/gnu-maintenance.scm (latest-html-release)[url-release]: Adjust computation in the case of an absolute URI-reference without a scheme. * tests/gnu-maintenance.scm ("latest-html-release, scheme-less URIs"): Test it. Signed-off-by: Christopher Baines <mail@cbaines.net> Maxime Devos