circlecloud/tmux
1
0
Fork 0
mirror of https://github.com/tmux/tmux.git synced 2026-10-06 17:49:52 +00:00
Code Issues Projects Releases Wiki Activity

Bounds check size and offsets for v1 layouts, found by ossfuzz.

Browse Source
This commit is contained in:
nicm
2026-09-28 09:32:06 +00:00
committed by tmux update bot
parent 11a0799925
commit abb1c79886
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
layout-custom.c
View File

@@ -1,4 +1,4 @@
/* $OpenBSD: layout-custom.c,v 1.43 2026/09/22 06:48:01 nicm Exp $ */ /* $OpenBSD: layout-custom.c,v 1.44 2026/09/28 09:32:06 nicm Exp $ */
/* /*
* Copyright (c) 2010 Nicholas Marriott <nicholas.marriott@gmail.com> * Copyright (c) 2010 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -826,7 +826,12 @@ layout_construct_cell(struct layout_cell *lcparent, const char **layout)
if (!isdigit((u_char) **layout)) if (!isdigit((u_char) **layout))
return (NULL); return (NULL);
if (sscanf(*layout, "%ux%u,%d,%d", &sx, &sy, &xoff, &yoff) != 4) if (sscanf(*layout, "%5ux%5u,%5d,%5d", &sx, &sy, &xoff, &yoff) != 4)
return (NULL);
if (sx < PANE_MINIMUM || sx > PANE_MAXIMUM ||
sy < PANE_MINIMUM || sy > PANE_MAXIMUM ||
xoff < 0 || xoff > WINDOW_MAXIMUM ||
yoff < 0 || yoff > WINDOW_MAXIMUM)
return (NULL); return (NULL);
while (isdigit((u_char) **layout)) while (isdigit((u_char) **layout))