Chewing_Bever
/
st
1
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

Simplify tdeletechar and tinsertblank and fix memory corruption. 

Current CSI parsing code uses strtol to parse arguments and allows them
to be negative. Negative argument is not properly handled in tdeletechar
and tinsertblank and results in memory corruption in memmove.

Reproduce with printf '\e[-500@'

Patch also removes special handling for corner case and simplifies
the code.

Removed
	term.dirty[term.c.y] = 1
because tclearregion sets dirty flag.
dev
noname 2014-04-23 02:08:13 +04:00 committed by Roberto E. Vargas Caballero
parent 16ac85bf54
commit 80b32af794
1 changed files with 12 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
st.c
View File

@ -1586,16 +1586,13 @@ tclearregion(int x1, int y1, int x2, int y2) {
void void
tdeletechar(int n) { tdeletechar(int n) {
int src = term.c.x + n; int dst, src, size;
int dst = term.c.x;
int size = term.col - src;
term.dirty[term.c.y] = 1; LIMIT(n, 0, term.col - term.c.x);
if(src >= term.col) { dst = term.c.x;
tclearregion(term.c.x, term.c.y, term.col-1, term.c.y); src = term.c.x + n;
return; size = term.col - src;
}
memmove(&term.line[term.c.y][dst], &term.line[term.c.y][src], memmove(&term.line[term.c.y][dst], &term.line[term.c.y][src],
size * sizeof(Glyph)); size * sizeof(Glyph));
@ -1604,16 +1601,13 @@ tdeletechar(int n) {
void void
tinsertblank(int n) { tinsertblank(int n) {
int src = term.c.x; int dst, src, size;
int dst = src + n;
int size = term.col - dst;
term.dirty[term.c.y] = 1; LIMIT(n, 0, term.col - term.c.x);
if(dst >= term.col) { dst = term.c.x + n;
tclearregion(term.c.x, term.c.y, term.col-1, term.c.y); src = term.c.x;
return; size = term.col - dst;
}
memmove(&term.line[term.c.y][dst], &term.line[term.c.y][src], memmove(&term.line[term.c.y][dst], &term.line[term.c.y][src],
size * sizeof(Glyph)); size * sizeof(Glyph));