From fe05143f5d70c89e4a14cbf61fee091dc6ba791c Mon Sep 17 00:00:00 2001 From: Christian Brabandt Date: Wed, 1 Apr 2026 15:27:51 +0000 Subject: patch 9.2.0279: terminal: out-of-bounds write with overlong CSI argument list Problem: libvterm CSI parser does not bounds-check argi against CSI_ARGS_MAX, allowing excess ';'-separated arguments to write past the end of the args array (sentinel404). Solution: Drop excess arguments. Supported by AI Signed-off-by: Christian Brabandt --- src/libvterm/src/parser.c | 2 ++ src/testdir/test_terminal3.vim | 11 +++++++++++ src/version.c | 2 ++ 3 files changed, 15 insertions(+) (limited to 'src') diff --git a/src/libvterm/src/parser.c b/src/libvterm/src/parser.c index 6d225166e3..b060e2b8ad 100644 --- a/src/libvterm/src/parser.c +++ b/src/libvterm/src/parser.c @@ -241,6 +241,8 @@ size_t vterm_input_write(VTerm *vt, const char *bytes, size_t len) c = ';'; } if(c == ';') { + if(vt->parser.v.csi.argi >= CSI_ARGS_MAX - 1) + break; /* drop excess args */ vt->parser.v.csi.argi++; vt->parser.v.csi.args[vt->parser.v.csi.argi] = CSI_ARG_MISSING; break; diff --git a/src/testdir/test_terminal3.vim b/src/testdir/test_terminal3.vim index 263b5f3093..cdfa189068 100644 --- a/src/testdir/test_terminal3.vim +++ b/src/testdir/test_terminal3.vim @@ -1229,4 +1229,15 @@ func Test_term_autowrite() set noautowrite endfunc +" Test that CSI sequences with more than CSI_ARGS_MAX arguments do not crash +func Test_terminal_csi_args_overflow() + CheckExecutable printf + let buf = term_start([&shell, &shellcmdflag, + \ 'printf "\033[' . repeat('1;', 49) . '1m"']) + + " If we get here without a crash, the fix works + call assert_equal('running', term_getstatus(buf)) + call StopVimInTerminal(buf) +endfunc + " vim: shiftwidth=2 sts=2 expandtab diff --git a/src/version.c b/src/version.c index 009c332761..43fee673fb 100644 --- a/src/version.c +++ b/src/version.c @@ -734,6 +734,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 279, /**/ 278, /**/ -- cgit 0.0.5-2-1-g0f52