st

Suckless' st with my personal patches
git clone https://git.instinctive.eu/st.git
Log | Files | Refs | README | LICENSE

commit 95f22c53059ccd60ee701ccf2659dacd95e4e89a
parent 7473a8d1a57e5f9aba41b953f4e498c35e1c9dc5
Author: Tommi Hirvola <tommi@hirvola.fi>
Date:   Mon,  4 Mar 2024 12:56:30 +0200

set upper limit for REP escape sequence argument

Previously, printf 'L\033[2147483647b' would call tputc('L') 2^31 times,
making st unresponsive. This commit allows repeating the last character
at most 65535 times in order to prevent freezing and DoS attacks.

Diffstat:
Mst.c | 2+-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/st.c b/st.c @@ -1643,7 +1643,7 @@ csihandle(void) ttywrite(vtiden, strlen(vtiden), 0); break; case 'b': /* REP -- if last char is printable print it <n> more times */ - DEFAULT(csiescseq.arg[0], 1); + LIMIT(csiescseq.arg[0], 1, 65535); if (term.lastc) while (csiescseq.arg[0]-- > 0) tputc(term.lastc);