mirror of
				https://github.com/tmux/tmux.git
				synced 2025-11-03 16:46:18 +00:00 
			
		
		
		
	Add a limit on how far format_expand can recurse.
This commit is contained in:
		
							
								
								
									
										10
									
								
								format.c
									
									
									
									
									
								
							
							
						
						
									
										10
									
								
								format.c
									
									
									
									
									
								
							@@ -100,6 +100,9 @@ format_job_cmp(struct format_job *fj1, struct format_job *fj2)
 | 
			
		||||
#define FORMAT_WINDOWS 0x100
 | 
			
		||||
#define FORMAT_PANES 0x200
 | 
			
		||||
 | 
			
		||||
/* Limit on recursion. */
 | 
			
		||||
#define FORMAT_LOOP_LIMIT 10
 | 
			
		||||
 | 
			
		||||
/* Entry in format tree. */
 | 
			
		||||
struct format_entry {
 | 
			
		||||
	char			*key;
 | 
			
		||||
@@ -122,6 +125,7 @@ struct format_tree {
 | 
			
		||||
	u_int			 tag;
 | 
			
		||||
	int			 flags;
 | 
			
		||||
	time_t			 time;
 | 
			
		||||
	u_int			 loop;
 | 
			
		||||
 | 
			
		||||
	RB_HEAD(format_entry_tree, format_entry) tree;
 | 
			
		||||
};
 | 
			
		||||
@@ -1512,6 +1516,10 @@ format_expand(struct format_tree *ft, const char *fmt)
 | 
			
		||||
	if (fmt == NULL)
 | 
			
		||||
		return (xstrdup(""));
 | 
			
		||||
 | 
			
		||||
	if (ft->loop == FORMAT_LOOP_LIMIT)
 | 
			
		||||
		return (xstrdup(""));
 | 
			
		||||
	ft->loop++;
 | 
			
		||||
 | 
			
		||||
	len = 64;
 | 
			
		||||
	buf = xmalloc(len);
 | 
			
		||||
	off = 0;
 | 
			
		||||
@@ -1606,6 +1614,8 @@ format_expand(struct format_tree *ft, const char *fmt)
 | 
			
		||||
	buf[off] = '\0';
 | 
			
		||||
 | 
			
		||||
	log_debug("%s: '%s' -> '%s'", __func__, saved, buf);
 | 
			
		||||
 | 
			
		||||
	ft->loop--;
 | 
			
		||||
	return (buf);
 | 
			
		||||
}
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user