summaryrefslogtreecommitdiff
path: root/sys/dev
diff options
context:
space:
mode:
authorriastradh <riastradh@NetBSD.org>2023-02-23 02:47:52 +0000
committerriastradh <riastradh@NetBSD.org>2023-02-23 02:47:52 +0000
commitb2965365aee324f2191f554bb50fb7a7eb827d1e (patch)
treefc98d4d510dbb7c36ce31f82fe40c68065a9b8cd /sys/dev
parente9bb888634d42bb6d201dcde130f12c8c9c2207b (diff)
wscons(4): Ignore nonsense tab stops in vt100 emulation.
XXX pullup-8 XXX pullup-9 XXX pullup-10
Diffstat (limited to 'sys/dev')
-rw-r--r--sys/dev/wscons/wsemul_vt100_subr.c24
1 files changed, 18 insertions, 6 deletions
diff --git a/sys/dev/wscons/wsemul_vt100_subr.c b/sys/dev/wscons/wsemul_vt100_subr.c
index 22d10fd75f3..8503430f062 100644
--- a/sys/dev/wscons/wsemul_vt100_subr.c
+++ b/sys/dev/wscons/wsemul_vt100_subr.c
@@ -1,4 +1,4 @@
-/* $NetBSD: wsemul_vt100_subr.c,v 1.26 2023/01/18 17:02:17 christos Exp $ */
+/* $NetBSD: wsemul_vt100_subr.c,v 1.27 2023/02/23 02:47:52 riastradh Exp $ */
/*
* Copyright (c) 1998
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: wsemul_vt100_subr.c,v 1.26 2023/01/18 17:02:17 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: wsemul_vt100_subr.c,v 1.27 2023/02/23 02:47:52 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -773,12 +773,22 @@ wsemul_vt100_handle_dcs(struct vt100base_data *edp)
char c = edp->dcsarg[i];
switch (c) {
case '0': case '1': case '2': case '3': case '4':
- case '5': case '6': case '7': case '8': case '9':
- pos = pos * 10 + (edp->dcsarg[i] - '0');
+ case '5': case '6': case '7': case '8': case '9': {
+ const int c0 = c - '0';
+ if (pos < 0 ||
+ pos > INT_MAX/10 ||
+ pos * 10 > edp->ncols - c0) {
+ pos = -1;
+ break;
+ }
+ pos = pos * 10 + c0;
break;
+ }
case '/':
- if (pos > 0)
+ if (pos > 0) {
+ KASSERT(pos <= edp->ncols);
edp->tabs[pos - 1] = 1;
+ }
pos = 0;
break;
default:
@@ -788,8 +798,10 @@ wsemul_vt100_handle_dcs(struct vt100base_data *edp)
break;
}
}
- if (pos > 0)
+ if (pos > 0) {
+ KASSERT(pos <= edp->ncols);
edp->tabs[pos - 1] = 1;
+ }
break;
default:
panic("wsemul_vt100_handle_dcs: bad type %d", edp->dcstype);