diff options
| author | Bojan Novković <bojan.novkovic@fer.hr> | 2023-11-13 18:02:30 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2023-12-04 14:06:29 +0000 |
| commit | 31f6cfca851f20099162352dac8d044857b2e1f9 (patch) | |
| tree | e20317f75ced03b561762765734f3d740e47384a | |
| parent | 4be96902ba82364810b86a6a0b3c58065e45e4cd (diff) | |
| download | src-31f6cfca851f20099162352dac8d044857b2e1f9.tar.gz src-31f6cfca851f20099162352dac8d044857b2e1f9.zip | |
tty: properly check character position when handling IUTF8 backspaces
The tty_rubchar() code handling backspaces for UTF-8 characters didn't
properly check whether the beginning of the current line was reached.
This resulted in a kernel panic in ttyinq_unputchar() when prodded with
certain malformed UTF-8 sequences.
PR: 275009
Reviewed by: christos
Differential Revision: https://reviews.freebsd.org/D42564
Approved by: so
Security: FreeBSD-EN-23:21.tty
(cherry picked from commit c6d7be214811c315d234d64c6cbaa92d4f55d2c1)
(cherry picked from commit ae8387cc818a0d6a2229ee049b671482e1549519)
| -rw-r--r-- | sys/kern/tty_ttydisc.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/sys/kern/tty_ttydisc.c b/sys/kern/tty_ttydisc.c index c46579cefbb1..cb5bf672d040 100644 --- a/sys/kern/tty_ttydisc.c +++ b/sys/kern/tty_ttydisc.c @@ -822,7 +822,13 @@ ttydisc_rubchar(struct tty *tp) /* Loop back through inq until we hit the * leading byte. */ while (CTL_UTF8_CONT(c) && nb < UTF8_STACKBUF) { - ttyinq_peekchar(&tp->t_inq, &c, "e); + /* + * Check if we've reached the beginning + * of the line. + */ + if (ttyinq_peekchar(&tp->t_inq, &c, + "e) != 0) + break; ttyinq_unputchar(&tp->t_inq); bytes[curidx] = c; curidx--; |