[vte/vte-0-32] emulation: Limit integer arguments to 65535



commit feeee4b5832b17641e505b7083e0d299fdae318e
Author: Christian Persch <chpe gnome org>
Date:   Sat May 19 19:36:09 2012 +0200

    emulation: Limit integer arguments to 65535
    
    To guard against malicious sequences containing excessively big numbers,
    limit all parsed numbers to 16 bit range. Doing this here in the parsing
    routine is a catch-all guard; this doesn't preclude enforcing
    more stringent limits in the handlers themselves.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=676090

 src/table.c  |    2 +-
 src/vteseq.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/src/table.c b/src/table.c
index 140e8c8..85cf631 100644
--- a/src/table.c
+++ b/src/table.c
@@ -550,7 +550,7 @@ _vte_table_extract_numbers(GValueArray **array,
 		if (G_UNLIKELY (*array == NULL)) {
 			*array = g_value_array_new(1);
 		}
-		g_value_set_long(&value, total);
+		g_value_set_long(&value, CLAMP (total, 0, G_MAXUSHORT));
 		g_value_array_append(*array, &value);
 	} while (i++ < arginfo->length);
 	g_value_unset(&value);
diff --git a/src/vteseq.c b/src/vteseq.c
index 457c06a..46def5b 100644
--- a/src/vteseq.c
+++ b/src/vteseq.c
@@ -557,7 +557,7 @@ vte_sequence_handler_multiple(VteTerminal *terminal,
                               GValueArray *params,
                               VteTerminalSequenceHandler handler)
 {
-        vte_sequence_handler_multiple_limited(terminal, params, handler, G_MAXLONG);
+        vte_sequence_handler_multiple_limited(terminal, params, handler, G_MAXUSHORT);
 }
 
 static void



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]