Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

avoid accessing stack garbage. 

on arm64eb resuming vi(1) would often crash.  in makech(), the 'csp'
variable is either set to current window data, or a local stack
variable's address '&blank'.  the window data has many lines of info
stored, and 'csp++' is used per line here.  unfortunately, a case
existed where 'csp++' operated on csp initialised from '&blank' which
eventually crashes when, on my display with 160 columns and 'csp + 155'
exceeds the mapped stack and crashes.

match the '!_cursesi_screen->curwin' conditional that initialises csp,
and avoid csp++ here.  assert() that csp != &blank in both places that
modify csp.

thanks to jdc@ and mlelstv@.

XXX: possibly also should avoid the putch() here as well.
This commit is contained in:
mrg 2021-05-08 04:29:07 +00:00
parent c06247ced2
commit ef48836c2e
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/libcurses/refresh.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: refresh.c,v 1.112 2020/02/24 12:20:29 rin Exp $ */
/* $NetBSD: refresh.c,v 1.113 2021/05/08 04:29:07 mrg Exp $ */
/*
* Copyright (c) 1981, 1993, 1994
@ -34,13 +34,14 @@
#if 0
static char sccsid[] = "@(#)refresh.c 8.7 (Berkeley) 8/13/94";
#else
__RCSID("$NetBSD: refresh.c,v 1.112 2020/02/24 12:20:29 rin Exp $");
__RCSID("$NetBSD: refresh.c,v 1.113 2021/05/08 04:29:07 mrg Exp $");
#endif
#endif /* not lint */
#include <poll.h>
#include <stdlib.h>
#include <string.h>
#include <assert.h>
#include "curses.h"
#include "curses_private.h"
@ -1322,6 +1323,7 @@ makech(int wy)
csp->ch = (wchar_t)btowc((int)' ');
SET_WCOL( *csp, 1 );
#endif /* HAVE_WCHAR */
assert(csp != &blank);
csp++;
}
return OK;
@ -1368,7 +1370,10 @@ makech(int wy)
{
if (putch(nsp, csp, wy, wx) == ERR)
return ERR;
csp++;
if (!_cursesi_screen->curwin) {
assert(csp != &blank);
csp++;
}
} else {
putattr(nsp);
putattr_out(nsp);