|
 |
c062768 |
From edc602651c506aeeb60544b55534dd1722a340d3 Mon Sep 17 00:00:00 2001
|
|
|
c062768 |
From: Rene Kita <mail@rkta.de>
|
|
|
c062768 |
Date: Thu, 13 Jul 2023 07:50:26 +0200
|
|
|
c062768 |
Subject: [PATCH] Fix OOB access due to multiple backspaces
|
|
|
c062768 |
|
|
|
c062768 |
Commit 419ca82d57 (Fix m17n backspace handling causes out-of-bounds
|
|
|
c062768 |
write in checkType) introduced an incomplete fix.
|
|
|
c062768 |
|
|
|
c062768 |
In function checkType we store the length of the previous multi-char
|
|
|
c062768 |
character in a buffer plens_buffer with pointer plens pointing to the
|
|
|
c062768 |
current position inside the buffer. When encountering a backspace plens
|
|
|
c062768 |
is set to the previous position without a bounds check. This will lead
|
|
|
c062768 |
to plens being out of bounds if we get more backspaces than we have
|
|
|
c062768 |
processed multi-char characters before.
|
|
|
c062768 |
|
|
|
c062768 |
If we are at the beginning of the buffer do not decrement and set plen
|
|
|
c062768 |
(the current length) to 0.
|
|
|
c062768 |
|
|
|
c062768 |
This also fixes GH Issue #270 [BUG] Out of bound read in Strnew_size ,
|
|
|
c062768 |
Str.c:61
|
|
|
c062768 |
|
|
|
c062768 |
If the above explanation does sound weird it's because I didn't fully
|
|
|
c062768 |
grok that function. :-)
|
|
|
c062768 |
---
|
|
|
c062768 |
etc.c | 10 ++++++++--
|
|
|
c062768 |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
c062768 |
|
|
|
c062768 |
diff --git a/etc.c b/etc.c
|
|
|
c062768 |
index 128717b18..b56615136 100644
|
|
|
c062768 |
--- a/etc.c
|
|
|
c062768 |
+++ b/etc.c
|
|
|
c062768 |
@@ -393,7 +393,10 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
|
|
|
c062768 |
if (color)
|
|
|
c062768 |
color -= plen;
|
|
|
c062768 |
#endif
|
|
|
c062768 |
- plen = *(--plens);
|
|
|
c062768 |
+ if (plens == plens_buffer)
|
|
|
c062768 |
+ plen = 0;
|
|
|
c062768 |
+ else
|
|
|
c062768 |
+ plen = *(--plens);
|
|
|
c062768 |
str += 2;
|
|
|
c062768 |
}
|
|
|
c062768 |
}
|
|
|
c062768 |
@@ -419,7 +422,10 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
|
|
|
c062768 |
if (color)
|
|
|
c062768 |
color -= plen;
|
|
|
c062768 |
#endif
|
|
|
c062768 |
- plen = *(--plens);
|
|
|
c062768 |
+ if (plens == plens_buffer)
|
|
|
c062768 |
+ plen = 0;
|
|
|
c062768 |
+ else
|
|
|
c062768 |
+ plen = *(--plens);
|
|
|
c062768 |
str++;
|
|
|
c062768 |
}
|
|
|
c062768 |
#else
|