billiob pushed a commit to branch terminology-1.4.

http://git.enlightenment.org/apps/terminology.git/commit/?id=f1837dbc0c51ac4a010eb732ab2ee86ceda0163b

commit f1837dbc0c51ac4a010eb732ab2ee86ceda0163b
Author: Boris Faure <[email protected]>
Date:   Sun May 5 11:41:10 2019 +0200

    termio: fix buffer overflow if too many \n
---
 src/bin/termio.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/src/bin/termio.c b/src/bin/termio.c
index 5018026..6334232 100644
--- a/src/bin/termio.c
+++ b/src/bin/termio.c
@@ -1029,18 +1029,17 @@ _getsel_cb(void *data,
 
         if (ev->len <= 0) return EINA_TRUE;
 
-        buf = malloc(ev->len);
+        buf = calloc(2, ev->len); /* twice in case the paste is only \n */
         if (buf)
           {
-             char *s = ev->data;
-             int i, j, pos = 0, prev_i;
+             const char *s = ev->data;
+             int i, j, pos = 0;
 
              /* apparently we have to convert \n into \r in terminal land. */
              for (i = 0; i < (int)ev->len && s[i];)
                {
                   Eina_Unicode g = 0;
-
-                  prev_i = i;
+                  int prev_i = i;
                   g = eina_unicode_utf8_next_get(s, &i);
                   /* Skip escape codes as a security measure */
                   if ((g < '\n') ||
@@ -1065,7 +1064,6 @@ _getsel_cb(void *data,
                     termpty_write(sd->pty, "\x1b[201~",
                                   sizeof("\x1b[201~") - 1);
                }
-
              free(buf);
           }
      }

-- 


Reply via email to