patch 9.2.0279: terminal: out-of-bounds write with overlong CSI argument list
Commit: https://github.com/vim/vim/commit/fe05143f5d70c89e4a14cbf61fee091dc6ba791c Author: Christian Brabandt <[email protected]> Date: Wed Apr 1 15:27:51 2026 +0000 patch 9.2.0279: terminal: out-of-bounds write with overlong CSI argument list Problem: libvterm CSI parser does not bounds-check argi against CSI_ARGS_MAX, allowing excess ';'-separated arguments to write past the end of the args array (sentinel404). Solution: Drop excess arguments. Supported by AI Signed-off-by: Christian Brabandt <[email protected]> diff --git a/src/libvterm/src/parser.c b/src/libvterm/src/parser.c index 6d225166e..b060e2b8a 100644 --- a/src/libvterm/src/parser.c +++ b/src/libvterm/src/parser.c @@ -241,6 +241,8 @@ size_t vterm_input_write(VTerm *vt, const char *bytes, size_t len) c = ';'; } if(c == ';') { + if(vt->parser.v.csi.argi >= CSI_ARGS_MAX - 1) + break; /* drop excess args */ vt->parser.v.csi.argi++; vt->parser.v.csi.args[vt->parser.v.csi.argi] = CSI_ARG_MISSING; break; diff --git a/src/testdir/test_terminal3.vim b/src/testdir/test_terminal3.vim index 263b5f309..cdfa18906 100644 --- a/src/testdir/test_terminal3.vim +++ b/src/testdir/test_terminal3.vim @@ -1229,4 +1229,15 @@ func Test_term_autowrite() set noautowrite endfunc +" Test that CSI sequences with more than CSI_ARGS_MAX arguments do not crash +func Test_terminal_csi_args_overflow() + CheckExecutable printf + let buf = term_start([&shell, &shellcmdflag, + \ 'printf " [' . repeat('1;', 49) . '1m"']) + + " If we get here without a crash, the fix works + call assert_equal('running', term_getstatus(buf)) + call StopVimInTerminal(buf) +endfunc + " vim: shiftwidth=2 sts=2 expandtab diff --git a/src/version.c b/src/version.c index 009c33276..43fee673f 100644 --- a/src/version.c +++ b/src/version.c @@ -734,6 +734,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 279, /**/ 278, /**/ -- -- You received this message from the "vim_dev" maillist. Do not top-post! Type your reply below the text you are replying to. For more information, visit http://www.vim.org/maillist.php --- You received this message because you are subscribed to the Google Groups "vim_dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/vim_dev/E1w7xke-00GiH5-21%40256bit.org.
