Applied-Software/ghostty
5
0
Fork 0
mirror of https://github.com/ghostty-org/ghostty.git synced 2025-07-15 08:16:13 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(terminal/stream): fix OOB read and integer overflow

Browse Source
This commit is contained in:
Qwerasd
2024-02-08 22:34:21 -05:00
parent 68c0813397
commit 777ecffe6b
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/terminal/stream.zig
View File

@ -75,13 +75,14 @@ pub fn Stream(comptime Handler: type) type {
try self.nextUtf8(input[offset]); try self.nextUtf8(input[offset]);
offset += 1; offset += 1;
} }
if (offset >= input.len) return;
// If we're not in the ground state then we process until // If we're not in the ground state then we process until
// we are. This can happen if the last chunk of input put us // we are. This can happen if the last chunk of input put us
// in the middle of a control sequence. // in the middle of a control sequence.
offset += try self.consumeUntilGround(input[offset..]); offset += try self.consumeUntilGround(input[offset..]);
offset += try self.consumeAllEscapes(input[offset..]);
if (offset >= input.len) return; if (offset >= input.len) return;
offset += try self.consumeAllEscapes(input[offset..]);
// If we're in the ground state then we can use SIMD to process // If we're in the ground state then we can use SIMD to process
// input until we see an ESC (0x1B), since all other characters // input until we see an ESC (0x1B), since all other characters
@ -219,8 +220,12 @@ pub fn Stream(comptime Handler: type) type {
0x18, 0x1A => self.parser.state = .ground, 0x18, 0x1A => self.parser.state = .ground,
// A parameter digit: // A parameter digit:
'0'...'9' => if (self.parser.params_idx < 16) { '0'...'9' => if (self.parser.params_idx < 16) {
self.parser.param_acc *= 10; self.parser.param_acc *|= 10;
self.parser.param_acc += c - '0'; self.parser.param_acc +|= c - '0';
// The parser's CSI param action uses param_acc_idx
// to decide if there's a final param that needs to
// be consumed or not, but it doesn't matter really
// what it is as long as it's not 0.
self.parser.param_acc_idx |= 1; self.parser.param_acc_idx |= 1;
}, },
// A parameter separator: // A parameter separator: