circlecloud/tmux
1
0
Fork 0
mirror of https://github.com/tmux/tmux.git synced 2026-04-16 03:56:28 +00:00
Code Issues Projects Releases Wiki Activity

Do not leak trimmed string when expanding, found by ossfuzz.

Browse Source
This commit is contained in:
nicm
2026-04-02 09:35:46 +00:00
parent be2c6f3b5e
commit c95d341220
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
format-draw.c
View File

@@ -1116,7 +1116,7 @@ format_width(const char *expanded)
/* /*
* Trim on the left, taking #[] into account. Note, we copy the whole set of * Trim on the left, taking #[] into account. Note, we copy the whole set of
* unescaped #s, but only add their escaped size to width. This is because the * unescaped #s, but only add their escaped size to width. This is because the
* format_draw function will actually do the escaping when it runs * format_draw function will actually do the escaping.
*/ */
char * char *
format_trim_left(const char *expanded, u_int limit) format_trim_left(const char *expanded, u_int limit)

2
format.c
View File

@@ -5325,6 +5325,7 @@ done:
if (marker != NULL && strcmp(new, value) != 0) { if (marker != NULL && strcmp(new, value) != 0) {
free(value); free(value);
xasprintf(&value, "%s%s", new, marker); xasprintf(&value, "%s%s", new, marker);
free(new);
} else { } else {
free(value); free(value);
value = new; value = new;
@@ -5335,6 +5336,7 @@ done:
if (marker != NULL && strcmp(new, value) != 0) { if (marker != NULL && strcmp(new, value) != 0) {
free(value); free(value);
xasprintf(&value, "%s%s", marker, new); xasprintf(&value, "%s%s", marker, new);
free(new);
} else { } else {
free(value); free(value);
value = new; value = new;