diff options
| author | Nei <ailin.nemui@gmail.com> | 2017-01-02 17:00:15 +0000 |
|---|---|---|
| committer | Nei <ailin.nemui@gmail.com> | 2017-01-02 17:00:15 +0000 |
| commit | 7daa7a6aa95fc80bc82b5de60d11d03483289400 (patch) | |
| tree | ea963023e7b0f2be30a1696726e7cbdc8ff63c76 | |
| parent | 1c6695107c09e8861a696d66b029e7df62589fcd (diff) | |
| parent | 7b856d628bfd6c775dfaee2138a3542ee13b1960 (diff) | |
| download | irssi-7daa7a6aa95fc80bc82b5de60d11d03483289400.zip | |
Merge branch '2-out-of-bounds-read-of-one-byte-with-x1b-48-in-truecolor-builds' into 'security'
check for end of string in ansi 48
See merge request !1
| -rw-r--r-- | src/fe-common/core/formats.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/fe-common/core/formats.c b/src/fe-common/core/formats.c index a58d839a..a789c0e3 100644 --- a/src/fe-common/core/formats.c +++ b/src/fe-common/core/formats.c @@ -956,6 +956,7 @@ static const char *get_ansi_color(THEME_REC *theme, const char *str, str++; for (num2 = 0; i_isdigit(*str); str++) num2 = num2*10 + (*str-'0'); + if (*str == '\0') return start; switch (num2) { case 2: @@ -973,6 +974,8 @@ static const char *get_ansi_color(THEME_REC *theme, const char *str, for (; i_isdigit(*str); str++) num2 = (num2&~0xff) | (((num2&0xff) * 10 + (*str-'0'))&0xff); + + if (*str == '\0') return start; } if (i == -1) break; @@ -1001,6 +1004,7 @@ static const char *get_ansi_color(THEME_REC *theme, const char *str, str++; for (num2 = 0; i_isdigit(*str); str++) num2 = num2*10 + (*str-'0'); + if (*str == '\0') return start; if (num == 38) { flags &= ~GUI_PRINT_FLAG_COLOR_24_FG; |