storm/w3m
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix m17n backspace handling causes out-of-bounds write in checkType

Browse Source 
[CVE-2022-38223]
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019599
Bug-Debian: https://github.com/tats/w3m/issues/242
This commit is contained in:
Tatsuya Kinoshita
2022-12-20 21:16:48 +09:00
parent c515ea8a47
commit 419ca82d57
1 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
etc.c
View File

@@ -256,6 +256,9 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
#ifdef USE_M17N #ifdef USE_M17N
int i; int i;
int plen = 0, clen; int plen = 0, clen;
int *plens = NULL;
static int *plens_buffer = NULL;
static int plens_size = 0;
#endif #endif
if (prop_size < s->length) { if (prop_size < s->length) {
@@ -263,6 +266,13 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
prop_buffer = New_Reuse(Lineprop, prop_buffer, prop_size); prop_buffer = New_Reuse(Lineprop, prop_buffer, prop_size);
} }
prop = prop_buffer; prop = prop_buffer;
#ifdef USE_M17N
if (plens_size < s->length) {
plens_size = (s->length > LINELEN) ? s->length : LINELEN;
plens_buffer = New_Reuse(int, plens_buffer, plens_size);
}
plens = plens_buffer;
#endif
if (ShowEffect) { if (ShowEffect) {
bs = memchr(str, '\b', s->length); bs = memchr(str, '\b', s->length);
@@ -297,14 +307,21 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
#ifdef USE_ANSI_COLOR #ifdef USE_ANSI_COLOR
if (color) if (color)
*(color++) = 0; *(color++) = 0;
#endif
#ifdef USE_M17N
*(plens++) = plen = 1;
#endif #endif
} }
Strcat_charp_n(s, sp, (int)(str - sp)); Strcat_charp_n(s, sp, (int)(str - sp));
} }
} }
if (!do_copy) { if (!do_copy) {
for (; str < endp && IS_ASCII(*str); str++) for (; str < endp && IS_ASCII(*str); str++) {
*(prop++) = PE_NORMAL | (IS_CNTRL(*str) ? PC_CTRL : PC_ASCII); *(prop++) = PE_NORMAL | (IS_CNTRL(*str) ? PC_CTRL : PC_ASCII);
#ifdef USE_M17N
*(plens++) = plen = 1;
#endif
}
} }
while (str < endp) { while (str < endp) {
@@ -366,6 +383,7 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
else { else {
Strshrink(s, plen); Strshrink(s, plen);
prop -= plen; prop -= plen;
plen = *(--plens);
str += 2; str += 2;
} }
} }
@@ -387,6 +405,7 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
else { else {
Strshrink(s, plen); Strshrink(s, plen);
prop -= plen; prop -= plen;
plen = *(--plens);
str++; str++;
} }
#else #else
@@ -441,6 +460,7 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
*(prop++) = mode; *(prop++) = mode;
#ifdef USE_M17N #ifdef USE_M17N
plen = get_mclen(str); plen = get_mclen(str);
*(plens++) = plen;
if (plen > 1) { if (plen > 1) {
mode = (mode & ~PC_WCHAR1) | PC_WCHAR2; mode = (mode & ~PC_WCHAR1) | PC_WCHAR2;
for (i = 1; i < plen; i++) { for (i = 1; i < plen; i++) {