diff options
| author | mrg <mrg@NetBSD.org> | 2021-05-08 04:29:07 +0000 |
|---|---|---|
| committer | mrg <mrg@NetBSD.org> | 2021-05-08 04:29:07 +0000 |
| commit | 7a9bf40eb7cb693caa9a331f012a4862c5cfd19c (patch) | |
| tree | 21e42fd6c32f26bb02e23d33180b43e9ed788ca5 /lib/libcurses | |
| parent | 2d92a360923461f2976750fb880c1c10bda0a84d (diff) | |
avoid accessing stack garbage.
on arm64eb resuming vi(1) would often crash. in makech(), the 'csp'
variable is either set to current window data, or a local stack
variable's address '&blank'. the window data has many lines of info
stored, and 'csp++' is used per line here. unfortunately, a case
existed where 'csp++' operated on csp initialised from '&blank' which
eventually crashes when, on my display with 160 columns and 'csp + 155'
exceeds the mapped stack and crashes.
match the '!_cursesi_screen->curwin' conditional that initialises csp,
and avoid csp++ here. assert() that csp != &blank in both places that
modify csp.
thanks to jdc@ and mlelstv@.
XXX: possibly also should avoid the putch() here as well.
Diffstat (limited to 'lib/libcurses')
| -rw-r--r-- | lib/libcurses/refresh.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/lib/libcurses/refresh.c b/lib/libcurses/refresh.c index c696ea64619..5bb68e64479 100644 --- a/lib/libcurses/refresh.c +++ b/lib/libcurses/refresh.c @@ -1,4 +1,4 @@ -/* $NetBSD: refresh.c,v 1.112 2020/02/24 12:20:29 rin Exp $ */ +/* $NetBSD: refresh.c,v 1.113 2021/05/08 04:29:07 mrg Exp $ */ /* * Copyright (c) 1981, 1993, 1994 @@ -34,13 +34,14 @@ #if 0 static char sccsid[] = "@(#)refresh.c 8.7 (Berkeley) 8/13/94"; #else -__RCSID("$NetBSD: refresh.c,v 1.112 2020/02/24 12:20:29 rin Exp $"); +__RCSID("$NetBSD: refresh.c,v 1.113 2021/05/08 04:29:07 mrg Exp $"); #endif #endif /* not lint */ #include <poll.h> #include <stdlib.h> #include <string.h> +#include <assert.h> #include "curses.h" #include "curses_private.h" @@ -1322,6 +1323,7 @@ makech(int wy) csp->ch = (wchar_t)btowc((int)' '); SET_WCOL( *csp, 1 ); #endif /* HAVE_WCHAR */ + assert(csp != &blank); csp++; } return OK; @@ -1368,7 +1370,10 @@ makech(int wy) { if (putch(nsp, csp, wy, wx) == ERR) return ERR; - csp++; + if (!_cursesi_screen->curwin) { + assert(csp != &blank); + csp++; + } } else { putattr(nsp); putattr_out(nsp); |
