Overtyping the first half of a wide character with the
second half of a wide character results in display garbage.
This is because the trailing dummy is not cleaned up.
i.e. ATTR_WIDE, ATTR_WDUMMY, ATTR_WDUMMY
Here is a short script for demonstrating the behavior:
#!/bin/sh
alias printf=/usr/bin/printf
printf こんにちは！; sleep 2
printf '\x1b[5D'; sleep 2
printf へ; sleep 2
printf ' '; sleep 2
echo
from the XmbTextListToTextProperty(3) man page:
"If insufficient memory is available for the new value string, the functions
return XNoMemory. If the current locale is not supported, the functions return
XLocaleNotSupported. In both of these error cases, the functions do not set
text_prop_return."
Reported by Steffen Nurpmeso <steffen@sdaoden.eu>, thanks!
In the current implementation, the slave PTY (assigned to the variable
`s') is always closed after duplicating it to file descriptors of
standard streams (0, 1, and 2). However, when the allocated slave PTY
`s' is already one of 0, 1, or 2, this causes unexpected closing of a
standard stream. The same problem occurs when the file descriptor of
the master PTY (the variable `m') is one of 0, 1, or 2.
In this patch, the original master PTY (m) is closed before it would
be overwritten by duplicated slave PTYs. The original slave PTY (s)
is closed only when it is not one of the stanrad streams.
The bits of uint signal in an XKeyEvent which concern the key group (keyboard
layout) are bits 13 and 14, as documented here:
https://www.x.org/releases/X11R7.7/doc/libX11/XKB/xkblib.html#Groups_and_Shift_Levels
In the older version, only bit 13 was marked as part of XK_SWITCH_MOD, this
causes issues for users who have more than two keymaps. the 14th bit is not
in ignoremod, key sequences are not caught by match(), if they switch to a third
or fourth keyboard.
These are typically mapped in X11 to the side-buttons (backward/forwards) on
the mouse. A comparison of the button numbers in SGR mode (first field):
st old:
0 1 2 64 65 66 67 68 69 70
st new (it is the same as xterm now):
0 1 2 64 65 66 67 128 129 130
A script to test and reproduce it, first argument is "h" (on) or "l" (off):
#!/bin/sh
printf '\x1b[?1000%s\x1b[?1006%s' "$1" "$1"
for n in 1 2 3 4 5 6 7 8 9 10; do
printf 'button %d\n' "$n"
xdotool click "$n"
printf '\n\n'
done
Reported on the mailinglist:
"
I discovered recently that if an application running inside st tries to
send a DCS string, subsequent Unicode characters get messed up. For
example, consider the following test-case:
printf '\303\277\033P\033\\\303\277'
...where:
- \303\277 is the UTF-8 encoding of U+00FF LATIN SMALL LETTER Y WITH
DIAERESIS (ÿ).
- \033P is ESC P, the token that begins a DCS string.
- \033\\ is ESC \, a token that ends a DCS string.
- \303\277 is the same ÿ character again.
If I run the above command in a VTE-based terminal, or xterm, or
QTerminal, or pterm (PuTTY), I get the output:
ÿÿ
...which is to say, the empty DCS string is ignored. However, if I run
that command inside st (as of commit 9ba7ecf), I get:
ÿÿ
...where those last two characters are \303\277 interpreted as ISO8859-1
characters, instead of UTF-8.
I spent some time tracing through the state machines in st.c, and so far
as I can tell, this is how it works currently:
- ESC P sets the "ESC_DCS" and "ESC_STR" flags, indicating that
incoming bytes should be collected into the strescseq buffer, rather
than being interpreted.
- ESC \ sets the "ESC_STR_END" flag (when ESC is received), and then
calls strhandle() (when \ is received) to interpret the collected
bytes.
- If the collected bytes begin with 'P' (i.e. if this was a DCS
string) strhandle() sets the "ESC_DCS" flag again, confusing the
state machine.
If my understanding is correct, fixing the problem should be as easy as
removing the line that sets ESC_DCS from strhandle():
diff --git a/st.c b/st.c
index ef8abd5..b5b805a 100644
--- a/st.c
+++ b/st.c
@@ -1897,7 +1897,6 @@ strhandle(void)
xsettitle(strescseq.args[0]);
return;
case 'P': /* DCS -- Device Control String */
- term.mode |= ESC_DCS;
case '_': /* APC -- Application Program Command */
case '^': /* PM -- Privacy Message */
return;
I've tried the above patch and it fixes my problem, but I don't know if
it introduces any others.
"
Similar to the xterm AllowWindowOps option, this is an option to allow or
disallow certain (non-interactive) operations that can be insecure or
exploited.
NOTE: xsettitle() is not guarded by this because st does not support printing
the window title. Else this could be exploitable (arbitrary code execution).
Similar problems have been found in the past in other terminal emulators.
The sequence for base64-encoded clipboard copy is now guarded because it allows
a sequence written to the terminal to manipulate the clipboard of the running
user non-interactively, for example:
printf '\x1b]52;0;ZWNobyBoaQ0=\a'
Add the functionality back in for xterm compatibility, but do not expose the
capability in st.info (yet).
Some notes:
It was reverted because it caused some issues with ncurses in some
configurations, namely when using BSD padding (--enable-bsdpad, BSD_TPUTS) in
ncurses it caused issues with repeating digits.
A fix has been upstreamed in ncurses since snapshot 20200523. The fix is also
backported to OpenBSD -current.
This reverts commit e8392b282c.
There is currently a bug in older ncurses versions (like on OpenBSD) where a
fix for a bug with REP is not backported yet. Most likely in tty/tty_update.c:
Noticed while using lynx (which uses ncurses/curses).
To reproduce using lynx: echo "Z0000000" | lynx -stdin
or using the program:
int
main(void)
{
WINDOW *win;
win = initscr();
printw("Z0000000");
refresh();
sleep(5);
return 0;
}
This prints "ZZZZZZZ" (incorrectly).
Jef Roosens
Hiltjo Posthuma
jamin
Jochen Sprickerhof
Raheman Vaiya
Koichi Murase
Petar Kapriš
Markus F.X.J. Oberhumer
John Collis
jef
Steve Ward