From 733abfcfc5b05cb3e1f2cf08f00a9325c6f6fa04 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Thu, 29 Oct 2020 16:33:01 +0000
Subject: Do not write after the end of the array and overwrite the stack when
 colon-separated SGR sequences contain empty arguments. Reported by Sergey
 Nizovtsev.

---
 input.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'input.c')

diff --git a/input.c b/input.c
index a3850371..60bfa8e2 100644
--- a/input.c
+++ b/input.c
@@ -1975,8 +1975,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
 				free(copy);
 				return;
 			}
-		} else
+		} else {
 			n++;
+			if (n == nitems(p)) {
+				free(copy);
+				return;
+			}
+		}
 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
 	}
 	free(copy);
-- 
cgit