summaryrefslogtreecommitdiff
path: root/lib/libcurses
diff options
context:
space:
mode:
authormrg <mrg@NetBSD.org>2021-05-08 04:29:07 +0000
committermrg <mrg@NetBSD.org>2021-05-08 04:29:07 +0000
commit7a9bf40eb7cb693caa9a331f012a4862c5cfd19c (patch)
tree21e42fd6c32f26bb02e23d33180b43e9ed788ca5 /lib/libcurses
parent2d92a360923461f2976750fb880c1c10bda0a84d (diff)
avoid accessing stack garbage.
on arm64eb resuming vi(1) would often crash. in makech(), the 'csp' variable is either set to current window data, or a local stack variable's address '&blank'. the window data has many lines of info stored, and 'csp++' is used per line here. unfortunately, a case existed where 'csp++' operated on csp initialised from '&blank' which eventually crashes when, on my display with 160 columns and 'csp + 155' exceeds the mapped stack and crashes. match the '!_cursesi_screen->curwin' conditional that initialises csp, and avoid csp++ here. assert() that csp != &blank in both places that modify csp. thanks to jdc@ and mlelstv@. XXX: possibly also should avoid the putch() here as well.
Diffstat (limited to 'lib/libcurses')
-rw-r--r--lib/libcurses/refresh.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/lib/libcurses/refresh.c b/lib/libcurses/refresh.c
index c696ea64619..5bb68e64479 100644
--- a/lib/libcurses/refresh.c
+++ b/lib/libcurses/refresh.c
@@ -1,4 +1,4 @@
-/* $NetBSD: refresh.c,v 1.112 2020/02/24 12:20:29 rin Exp $ */
+/* $NetBSD: refresh.c,v 1.113 2021/05/08 04:29:07 mrg Exp $ */
/*
* Copyright (c) 1981, 1993, 1994
@@ -34,13 +34,14 @@
#if 0
static char sccsid[] = "@(#)refresh.c 8.7 (Berkeley) 8/13/94";
#else
-__RCSID("$NetBSD: refresh.c,v 1.112 2020/02/24 12:20:29 rin Exp $");
+__RCSID("$NetBSD: refresh.c,v 1.113 2021/05/08 04:29:07 mrg Exp $");
#endif
#endif /* not lint */
#include <poll.h>
#include <stdlib.h>
#include <string.h>
+#include <assert.h>
#include "curses.h"
#include "curses_private.h"
@@ -1322,6 +1323,7 @@ makech(int wy)
csp->ch = (wchar_t)btowc((int)' ');
SET_WCOL( *csp, 1 );
#endif /* HAVE_WCHAR */
+ assert(csp != &blank);
csp++;
}
return OK;
@@ -1368,7 +1370,10 @@ makech(int wy)
{
if (putch(nsp, csp, wy, wx) == ERR)
return ERR;
- csp++;
+ if (!_cursesi_screen->curwin) {
+ assert(csp != &blank);
+ csp++;
+ }
} else {
putattr(nsp);
putattr_out(nsp);