diff options
| author | Christian Brabandt <cb@256bit.org> | 2026-04-01 15:27:51 +0000 |
|---|---|---|
| committer | Christian Brabandt <cb@256bit.org> | 2026-04-01 15:36:23 +0000 |
| commit | fe05143f5d70c89e4a14cbf61fee091dc6ba791c (patch) | |
| tree | b52a83c65d367a224bc36fbc200ef028683fa9d1 /src/testdir | |
| parent | b2e55ed1d6c9d9af0e1afa6deedf0fec7a49c8c8 (diff) | |
| download | Project-Tick-fe05143f5d70c89e4a14cbf61fee091dc6ba791c.tar.gz Project-Tick-fe05143f5d70c89e4a14cbf61fee091dc6ba791c.zip | |
patch 9.2.0279: terminal: out-of-bounds write with overlong CSI argument list
Problem: libvterm CSI parser does not bounds-check argi against
CSI_ARGS_MAX, allowing excess ';'-separated arguments to
write past the end of the args array (sentinel404).
Solution: Drop excess arguments.
Supported by AI
Signed-off-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/testdir')
| -rw-r--r-- | src/testdir/test_terminal3.vim | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/testdir/test_terminal3.vim b/src/testdir/test_terminal3.vim index 263b5f3093..cdfa189068 100644 --- a/src/testdir/test_terminal3.vim +++ b/src/testdir/test_terminal3.vim @@ -1229,4 +1229,15 @@ func Test_term_autowrite() set noautowrite endfunc +" Test that CSI sequences with more than CSI_ARGS_MAX arguments do not crash +func Test_terminal_csi_args_overflow() + CheckExecutable printf + let buf = term_start([&shell, &shellcmdflag, + \ 'printf "\033[' . repeat('1;', 49) . '1m"']) + + " If we get here without a crash, the fix works + call assert_equal('running', term_getstatus(buf)) + call StopVimInTerminal(buf) +endfunc + " vim: shiftwidth=2 sts=2 expandtab |