diff options
| author | Ed Schouten <ed@FreeBSD.org> | 2015-08-21 06:30:13 +0000 |
|---|---|---|
| committer | Ed Schouten <ed@FreeBSD.org> | 2015-08-21 06:30:13 +0000 |
| commit | 9a71fa376b4efc90484663b76cab2ec32380e0a6 (patch) | |
| tree | 505aa78ce443b57b765cec3f4eb890e0b6d2cb84 /sys/teken | |
| parent | 328b9e0bca2459b08226526a30de9bb1a0a87841 (diff) | |
| download | src-9a71fa376b4efc90484663b76cab2ec32380e0a6.tar.gz src-9a71fa376b4efc90484663b76cab2ec32380e0a6.zip | |
Don't truncate cursor arithmetic to 16 bits.
When updating the row number when the cursor position escape sequence is
issued, we should make sure to store the intermediate result in a 32-bit
integer. If we fail to do this, the cursor may be set above the origin
region, which is bad.
This could cause libteken to crash when INVARIANTS is enabled, due to
the strict set of assertions that libteken has.
PR: 202540
Reported by: kcwu csie org
MFC after: 1 month
Notes
Notes:
svn path=/head/; revision=286981
Diffstat (limited to 'sys/teken')
| -rw-r--r-- | sys/teken/teken_subr.h | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/sys/teken/teken_subr.h b/sys/teken/teken_subr.h index 2eee6279c970..c686b916f9d3 100644 --- a/sys/teken/teken_subr.h +++ b/sys/teken/teken_subr.h @@ -324,13 +324,13 @@ static void teken_subr_cursor_position(teken_t *t, unsigned int row, unsigned int col) { - t->t_cursor.tp_row = t->t_originreg.ts_begin + row - 1; - if (t->t_cursor.tp_row >= t->t_originreg.ts_end) - t->t_cursor.tp_row = t->t_originreg.ts_end - 1; + row = row - 1 + t->t_originreg.ts_begin; + t->t_cursor.tp_row = row < t->t_originreg.ts_end ? + row : t->t_originreg.ts_end - 1; - t->t_cursor.tp_col = col - 1; - if (t->t_cursor.tp_col >= t->t_winsize.tp_col) - t->t_cursor.tp_col = t->t_winsize.tp_col - 1; + col--; + t->t_cursor.tp_col = col < t->t_winsize.tp_col ? + col : t->t_winsize.tp_col - 1; t->t_stateflags &= ~TS_WRAPPED; teken_funcs_cursor(t); |