3.1c.

Do not write after the end of the array and overwrite the stack when
colon-separated SGR sequences contain empty arguments. Reported by Sergey Nizovtsev.
2026-03-12 03:25:45 +00:00 · 2020-10-30 12:11:02 +00:00 · 2020-10-30 12:09:52 +00:00 · 2020-05-04 09:06:57 +01:00 · 2020-05-03 10:49:16 +01:00
4 changed files with 13 additions and 3 deletions
--- a/6
+++ b/6
@@ -1,5 +1,11 @@
+CHANGED FROM 3.1b TO 3.1c
+
+* Fix a stack overflow on colon-separated CSI parsing.
+
 CHANGES FROM 3.1a TO 3.1b

+* Fix build on systems without sys/queue.h.
+
 * Fix crash when allow-rename is on and an empty name is set.

 CHANGES FROM 3.1 TO 3.1a
--- a/configure.ac
+++ b/configure.ac
@@ -1,6 +1,6 @@
 # configure.ac

-AC_INIT([tmux], 3.1b)
+AC_INIT([tmux], 3.1c)
 AC_PREREQ([2.60])

 AC_CONFIG_AUX_DIR(etc)
--- a/file.c
+++ b/file.c
@@ -17,7 +17,6 @@
 */

 #include <sys/types.h>
-#include <sys/queue.h>

 #include <errno.h>
 #include <fcntl.h>
--- a/input.c
+++ b/input.c
@@ -1929,8 +1929,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
 				free(copy);
 				return;
 			}
-		} else
+		} else {
 			n++;
+			if (n == nitems(p)) {
+				free(copy);
+				return;
+			}
+		}
 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
 	}
 	free(copy);
Author	SHA1	Message	Date
Nicholas Marriott	25cae5d86f	3.1c.	2020-10-30 12:11:02 +00:00
nicm	d0ad34e94d	Do not write after the end of the array and overwrite the stack when colon-separated SGR sequences contain empty arguments. Reported by Sergey Nizovtsev.	2020-10-30 12:09:52 +00:00
Nicholas Marriott	a10c4c60cb	Add to CHANGES.	2020-05-04 09:06:57 +01:00
Nicholas Marriott	846b99e0cb	Portable does not need sys/queue.h.	2020-05-03 10:49:16 +01:00