diff options
| author | christos <christos@NetBSD.org> | 2018-11-25 16:21:04 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2018-11-25 16:21:04 +0000 |
| commit | 38c1ab663cf731dedf6d29f2307ce6eb403f9a3d (patch) | |
| tree | e5c5968f8e350312641cd0c707912fc257ea322a /lib/libedit | |
| parent | 487bfba7cfadaab7a1c438ef2a6d8fde37fbf7e8 (diff) | |
From Yuichiro Naito (FreeBSD):
hrs@ says that
(cbp >= MB_LEN_MAX) condition is necessary for checking invalid
byte sequences. If malicious input was given, libedit would read
byte sequences forever.
Diffstat (limited to 'lib/libedit')
| -rw-r--r-- | lib/libedit/read.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/lib/libedit/read.c b/lib/libedit/read.c index 64534c78e05..0d7dd9586e7 100644 --- a/lib/libedit/read.c +++ b/lib/libedit/read.c @@ -1,4 +1,4 @@ -/* $NetBSD: read.c,v 1.104 2018/11/18 17:09:39 christos Exp $ */ +/* $NetBSD: read.c,v 1.105 2018/11/25 16:21:04 christos Exp $ */ /*- * Copyright (c) 1992, 1993 @@ -37,7 +37,7 @@ #if 0 static char sccsid[] = "@(#)read.c 8.1 (Berkeley) 6/4/93"; #else -__RCSID("$NetBSD: read.c,v 1.104 2018/11/18 17:09:39 christos Exp $"); +__RCSID("$NetBSD: read.c,v 1.105 2018/11/25 16:21:04 christos Exp $"); #endif #endif /* not lint && not SCCSID */ @@ -335,6 +335,11 @@ read_char(EditLine *el, wchar_t *cp) goto again; } case (size_t)-2: + if (cbp >= MB_LEN_MAX) { + errno = EILSEQ; + *cp = L'\0'; + return -1; + } /* Incomplete sequence, read another byte. */ goto again; default: |
