diff options
| author | riastradh <riastradh@NetBSD.org> | 2023-02-23 02:47:52 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2023-02-23 02:47:52 +0000 |
| commit | b2965365aee324f2191f554bb50fb7a7eb827d1e (patch) | |
| tree | fc98d4d510dbb7c36ce31f82fe40c68065a9b8cd /sys/dev | |
| parent | e9bb888634d42bb6d201dcde130f12c8c9c2207b (diff) | |
wscons(4): Ignore nonsense tab stops in vt100 emulation.
XXX pullup-8
XXX pullup-9
XXX pullup-10
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/wscons/wsemul_vt100_subr.c | 24 |
1 files changed, 18 insertions, 6 deletions
diff --git a/sys/dev/wscons/wsemul_vt100_subr.c b/sys/dev/wscons/wsemul_vt100_subr.c index 22d10fd75f3..8503430f062 100644 --- a/sys/dev/wscons/wsemul_vt100_subr.c +++ b/sys/dev/wscons/wsemul_vt100_subr.c @@ -1,4 +1,4 @@ -/* $NetBSD: wsemul_vt100_subr.c,v 1.26 2023/01/18 17:02:17 christos Exp $ */ +/* $NetBSD: wsemul_vt100_subr.c,v 1.27 2023/02/23 02:47:52 riastradh Exp $ */ /* * Copyright (c) 1998 @@ -27,7 +27,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: wsemul_vt100_subr.c,v 1.26 2023/01/18 17:02:17 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: wsemul_vt100_subr.c,v 1.27 2023/02/23 02:47:52 riastradh Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -773,12 +773,22 @@ wsemul_vt100_handle_dcs(struct vt100base_data *edp) char c = edp->dcsarg[i]; switch (c) { case '0': case '1': case '2': case '3': case '4': - case '5': case '6': case '7': case '8': case '9': - pos = pos * 10 + (edp->dcsarg[i] - '0'); + case '5': case '6': case '7': case '8': case '9': { + const int c0 = c - '0'; + if (pos < 0 || + pos > INT_MAX/10 || + pos * 10 > edp->ncols - c0) { + pos = -1; + break; + } + pos = pos * 10 + c0; break; + } case '/': - if (pos > 0) + if (pos > 0) { + KASSERT(pos <= edp->ncols); edp->tabs[pos - 1] = 1; + } pos = 0; break; default: @@ -788,8 +798,10 @@ wsemul_vt100_handle_dcs(struct vt100base_data *edp) break; } } - if (pos > 0) + if (pos > 0) { + KASSERT(pos <= edp->ncols); edp->tabs[pos - 1] = 1; + } break; default: panic("wsemul_vt100_handle_dcs: bad type %d", edp->dcstype); |
