summaryrefslogtreecommitdiff
path: root/sysutils/screen/files/patch-CVE-2015-6806
blob: fac3aa79325ca4ffebc8490af3f7ff908a45c059 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
From b7484c224738247b510ed0d268cd577076958f1b Mon Sep 17 00:00:00 2001
From: Kuang-che Wu <kcwu@csie.org>
Date: Mon, 31 Aug 2015 17:49:57 +0000
Subject: Fix stack overflow due to too deep recursion

Bug: 45713

How to reproduce:
Run this command inside screen
$ printf '\x1b[10000000T'

screen will recursively call MScrollV to depth n/256. This is time consuming and will overflow stack if n is huge.
---
diff --git a/src/ansi.c b/src/ansi.c
index a342fb1..152d2ef 100644
--- ansi.c
+++ ansi.c
@@ -2502,13 +2502,13 @@ int n, ys, ye, bce;
     return;
   if (n > 0)
     {
+      if (ye - ys + 1 < n)
+	n = ye - ys + 1;
       if (n > 256)
 	{
 	  MScrollV(p, n - 256, ys, ye, bce);
 	  n = 256;
 	}
-      if (ye - ys + 1 < n)
-	n = ye - ys + 1;
 #ifdef COPY_PASTE
       if (compacthist)
 	{
@@ -2562,14 +2562,14 @@ int n, ys, ye, bce;
     }
   else
     {
-      if (n < -256)
-	{
-	  MScrollV(p, n + 256, ys, ye, bce);
-	  n = -256;
-	}
       n = -n;
       if (ye - ys + 1 < n)
 	n = ye - ys + 1;
+      if (n > 256)
+	{
+	  MScrollV(p, - (n - 256), ys, ye, bce);
+	  n = 256;
+	}
 
       ml = p->w_mlines + ye;
       /* Clear lines */
--
cgit v0.9.0.2