mirror of
https://github.com/tmux/tmux.git
synced 2026-03-09 17:30:16 +00:00
Do not use recallocarray because the stored size may have changed during
reflow so may not match what it expects, fixes crash reported by Caspar Schutijser.
This commit is contained in:
11
grid.c
11
grid.c
@@ -495,7 +495,7 @@ static void
|
||||
grid_expand_line(struct grid *gd, u_int py, u_int sx, u_int bg)
|
||||
{
|
||||
struct grid_line *gl;
|
||||
u_int xx, old_cellsize;
|
||||
u_int xx;
|
||||
|
||||
gl = &gd->linedata[py];
|
||||
if (sx <= gl->cellsize)
|
||||
@@ -508,10 +508,13 @@ grid_expand_line(struct grid *gd, u_int py, u_int sx, u_int bg)
|
||||
else if (gd->sx > sx)
|
||||
sx = gd->sx;
|
||||
|
||||
old_cellsize = gl->cellsize;
|
||||
gl->celldata = xrecallocarray(gl->celldata, old_cellsize, sx,
|
||||
gl->celldata = xreallocarray(gl->celldata, sx,
|
||||
sizeof *gl->celldata);
|
||||
for (xx = old_cellsize; xx < sx; xx++)
|
||||
if (gl->cellsize < sx) {
|
||||
memset(gl->celldata + gl->cellsize, 0,
|
||||
(sx - gl->cellsize) * sizeof *gl->celldata);
|
||||
}
|
||||
for (xx = gl->cellsize; xx < sx; xx++)
|
||||
grid_clear_cell(gd, xx, py, bg);
|
||||
gl->cellsize = sx;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user