summaryrefslogtreecommitdiff
path: root/lib/libedit
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2018-11-25 16:21:04 +0000
committerchristos <christos@NetBSD.org>2018-11-25 16:21:04 +0000
commit38c1ab663cf731dedf6d29f2307ce6eb403f9a3d (patch)
treee5c5968f8e350312641cd0c707912fc257ea322a /lib/libedit
parent487bfba7cfadaab7a1c438ef2a6d8fde37fbf7e8 (diff)
From Yuichiro Naito (FreeBSD):
hrs@ says that (cbp >= MB_LEN_MAX) condition is necessary for checking invalid byte sequences. If malicious input was given, libedit would read byte sequences forever.
Diffstat (limited to 'lib/libedit')
-rw-r--r--lib/libedit/read.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/lib/libedit/read.c b/lib/libedit/read.c
index 64534c78e05..0d7dd9586e7 100644
--- a/lib/libedit/read.c
+++ b/lib/libedit/read.c
@@ -1,4 +1,4 @@
-/* $NetBSD: read.c,v 1.104 2018/11/18 17:09:39 christos Exp $ */
+/* $NetBSD: read.c,v 1.105 2018/11/25 16:21:04 christos Exp $ */
/*-
* Copyright (c) 1992, 1993
@@ -37,7 +37,7 @@
#if 0
static char sccsid[] = "@(#)read.c 8.1 (Berkeley) 6/4/93";
#else
-__RCSID("$NetBSD: read.c,v 1.104 2018/11/18 17:09:39 christos Exp $");
+__RCSID("$NetBSD: read.c,v 1.105 2018/11/25 16:21:04 christos Exp $");
#endif
#endif /* not lint && not SCCSID */
@@ -335,6 +335,11 @@ read_char(EditLine *el, wchar_t *cp)
goto again;
}
case (size_t)-2:
+ if (cbp >= MB_LEN_MAX) {
+ errno = EILSEQ;
+ *cp = L'\0';
+ return -1;
+ }
/* Incomplete sequence, read another byte. */
goto again;
default: