Do not write after the end of the array and overwrite the stack when

colon-separated SGR sequences contain empty arguments. Reported by Sergey Nizovtsev.
2020-10-29 16:33:01 +00:00 · 2020-10-29 16:33:01 +00:00 · 733abfcfc5
parent 7a4aa14618
commit 733abfcfc5
1 changed files with 6 additions and 1 deletions
--- a/input.c
+++ b/input.c
@ -1975,8 +1975,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
 				free(copy);
 				return;
 			}
-		} else
+		} else {
 			n++;
+			if (n == nitems(p)) {
+				free(copy);
+				return;
+			}
+		}
 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
 	}
 	free(copy);