circlecloud/tmux
1
0
Fork 0
mirror of https://github.com/tmux/tmux.git synced 2026-10-12 05:34:24 +00:00
Code Issues Projects Releases Wiki Activity

Reject out of range SIXEL numbers and oversized decoded images.

Browse Source
This commit is contained in:
Michael Grant
2026-10-09 22:50:43 +02:00
parent e29f9f7076
commit 5d1c25c5c9
1 changed files with 21 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
image-sixel.c
View File

@@ -244,6 +244,18 @@ sixel_parse_write(struct sixel_image *si, u_int ch)
return (0); return (0);
} }
/* Parse a number, clamping values too large for u_int so limit checks fail. */
static u_int
sixel_parse_number(const char *cp, char **endptr)
{
unsigned long value;
value = strtoul(cp, endptr, 10);
if (value > UINT_MAX)
return (UINT_MAX);
return (value);
}
/* Parse a SIXEL raster attribute sequence. */ /* Parse a SIXEL raster attribute sequence. */
static const char * static const char *
sixel_parse_attributes(struct sixel_image *si, const char *cp, const char *end) sixel_parse_attributes(struct sixel_image *si, const char *cp, const char *end)
@@ -269,7 +281,7 @@ sixel_parse_attributes(struct sixel_image *si, const char *cp, const char *end)
return (NULL); return (NULL);
} }
x = strtoul(endptr + 1, &endptr, 10); x = sixel_parse_number(endptr + 1, &endptr);
if (endptr == last || *endptr != ';') { if (endptr == last || *endptr != ';') {
log_debug("%s: missing ;", __func__); log_debug("%s: missing ;", __func__);
return (NULL); return (NULL);
@@ -278,7 +290,7 @@ sixel_parse_attributes(struct sixel_image *si, const char *cp, const char *end)
log_debug("%s: image is too wide", __func__); log_debug("%s: image is too wide", __func__);
return (NULL); return (NULL);
} }
y = strtoul(endptr + 1, &endptr, 10); y = sixel_parse_number(endptr + 1, &endptr);
if (endptr != last) { if (endptr != last) {
log_debug("%s: extra ;", __func__); log_debug("%s: extra ;", __func__);
return (NULL); return (NULL);
@@ -313,7 +325,7 @@ sixel_parse_colour(struct sixel_image *si, const char *cp, const char *end)
last++; last++;
} }
c = strtoul(cp, &endptr, 10); c = sixel_parse_number(cp, &endptr);
if (c > SIXEL_COLOUR_REGISTERS) { if (c > SIXEL_COLOUR_REGISTERS) {
log_debug("%s: too many colours", __func__); log_debug("%s: too many colours", __func__);
return (NULL); return (NULL);
@@ -324,22 +336,22 @@ sixel_parse_colour(struct sixel_image *si, const char *cp, const char *end)
if (endptr == last || *endptr != ';') if (endptr == last || *endptr != ';')
return (last); return (last);
type = strtoul(endptr + 1, &endptr, 10); type = sixel_parse_number(endptr + 1, &endptr);
if (endptr == last || *endptr != ';') { if (endptr == last || *endptr != ';') {
log_debug("%s: missing ;", __func__); log_debug("%s: missing ;", __func__);
return (NULL); return (NULL);
} }
c1 = strtoul(endptr + 1, &endptr, 10); c1 = sixel_parse_number(endptr + 1, &endptr);
if (endptr == last || *endptr != ';') { if (endptr == last || *endptr != ';') {
log_debug("%s: missing ;", __func__); log_debug("%s: missing ;", __func__);
return (NULL); return (NULL);
} }
c2 = strtoul(endptr + 1, &endptr, 10); c2 = sixel_parse_number(endptr + 1, &endptr);
if (endptr == last || *endptr != ';') { if (endptr == last || *endptr != ';') {
log_debug("%s: missing ;", __func__); log_debug("%s: missing ;", __func__);
return (NULL); return (NULL);
} }
c3 = strtoul(endptr + 1, &endptr, 10); c3 = sixel_parse_number(endptr + 1, &endptr);
if (endptr != last) { if (endptr != last) {
log_debug("%s: missing ;", __func__); log_debug("%s: missing ;", __func__);
return (NULL); return (NULL);
@@ -582,9 +594,9 @@ sixel_to_image(struct sixel_image *si)
u_int x, y, c, sx, sy; u_int x, y, c, sx, sy;
struct image *im; struct image *im;
if ((uint64_t)si->sx * si->sy * 4 > SIZE_MAX) if ((uint64_t)si->sx * si->sy > IMAGE_SIZE_LIMIT / 4)
return (NULL); return (NULL);
pixels = xcalloc(si->sx * si->sy, 4); pixels = xcalloc((size_t)si->sx * si->sy, 4);
for (y = 0; y < si->sy; y++) { for (y = 0; y < si->sy; y++) {
for (x = 0; x < si->sx; x++) { for (x = 0; x < si->sx; x++) {
c = sixel_get_pixel(si, x, y); c = sixel_get_pixel(si, x, y);