Fix 3 out of bound reads - #65
Merged
Merged
Conversation
1) Heap out-of-bounds READ — tsm_screen_tab_left (src/tsm/tsm-screen.c)
A cursor-forward-tab (CHT, ESC [ n I) followed by a wide glyph at the last column
can leave cursor_x > size_x; a following cursor-backward-tab (CBT, ESC [ Z) then
reads tab_ruler[cursor_x - 1], past the size_x-element ruler:
==ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1
in tsm_screen_tab_left src/tsm/tsm-screen.c:1354
in do_csi / do_action / do_trans / tsm_vte_input
Reported-by: Benjamin Ali (glitchfox) <glitchfox@benjaminali.com>
Signed-off-by: Benjamin Ali (glitchfox) <glitchfox@benjaminali.com>
Out-of-bounds READ via unbounded OSC 4 color index — lookup_color (src/tsm/tsm-vte.c)
do_osc_4 (ESC ] 4 ; <index> ; ? ) parses <index> as an unbounded unsigned int and
passes it to lookup_color(int color). A large value wraps to a negative int,
passes the `color < 16` test, and reaches palette_rgb() -> vte->palette[color] —
a wild read that SIGSEGVs:
==ERROR: AddressSanitizer: SEGV ... READ memory access
in palette_rgb src/tsm/tsm-vte.c:1284
in lookup_color src/tsm/tsm-vte.c:1310
in do_osc_4 src/tsm/tsm-vte.c:2237
The read colour is also written back in the OSC-4 query reply, so a non-faulting
read is an information leak. Large positive indices additionally mis-index
cube_rgb's bval[] and overflow greyscale_rgb — same root cause.
Reported-by: Benjamin Ali (glitchfox) <glitchfox@benjaminali.com>
Signed-off-by: Benjamin Ali (glitchfox) <glitchfox@benjaminali.com>
Out-of-bounds READ of csi_argv[16] — csi_attribute (src/tsm/tsm-vte.c)
csi_argv is int[CSI_ARG_MAX] with CSI_ARG_MAX == 16. In the SGR 38/48 handling,
csi_argv[i + 1] is read before i + 1 is bounds-checked (the i+2 >= csi_argc guard
comes after). An SGR whose 38/48 is the 16th argument reads csi_argv[16]:
src/tsm/tsm-vte.c:1482: runtime error: index 16 out of bounds for type 'int[16]'
in csi_attribute -> do_csi -> ... -> tsm_vte_input
Reported-by: Benjamin Ali (glitchfox) <glitchfox@benjaminali.com>
Signed-off-by: Benjamin Ali (glitchfox) <glitchfox@benjaminali.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.