david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

console: bounds check whenever changing the cursor due to an escape code

Browse Source 
This is XSA-17 / CVE-2012-3515

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Ian Campbell 2012-09-04 10:26:09 -05:00 committed by Anthony Liguori
parent de188751da
commit 3eea5498ca
1 changed files with 28 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
console.c
View File

@ -850,6 +850,26 @@ static void console_clear_xy(TextConsole *s, int x, int y)
update_xy(s, x, y); update_xy(s, x, y);
} }
/* set cursor, checking bounds */
static void set_cursor(TextConsole *s, int x, int y)
{
if (x < 0) {
x = 0;
}
if (y < 0) {
y = 0;
}
if (y >= s->height) {
y = s->height - 1;
}
if (x >= s->width) {
x = s->width - 1;
}
s->x = x;
s->y = y;
}
static void console_putchar(TextConsole *s, int ch) static void console_putchar(TextConsole *s, int ch)
{ {
TextCell *c; TextCell *c;
@ -921,6 +941,7 @@ static void console_putchar(TextConsole *s, int ch)
s->esc_params[s->nb_esc_params] * 10 + ch - '0'; s->esc_params[s->nb_esc_params] * 10 + ch - '0';
} }
} else { } else {
if (s->nb_esc_params < MAX_ESC_PARAMS)
s->nb_esc_params++; s->nb_esc_params++;
if (ch == ';') if (ch == ';')
break; break;
@ -935,59 +956,37 @@ static void console_putchar(TextConsole *s, int ch)
if (s->esc_params[0] == 0) { if (s->esc_params[0] == 0) {
s->esc_params[0] = 1; s->esc_params[0] = 1;
} }
s->y -= s->esc_params[0]; set_cursor(s, s->x, s->y - s->esc_params[0]);
if (s->y < 0) {
s->y = 0;
}
break; break;
case 'B': case 'B':
/* move cursor down */ /* move cursor down */
if (s->esc_params[0] == 0) { if (s->esc_params[0] == 0) {
s->esc_params[0] = 1; s->esc_params[0] = 1;
} }
s->y += s->esc_params[0]; set_cursor(s, s->x, s->y + s->esc_params[0]);
if (s->y >= s->height) {
s->y = s->height - 1;
}
break; break;
case 'C': case 'C':
/* move cursor right */ /* move cursor right */
if (s->esc_params[0] == 0) { if (s->esc_params[0] == 0) {
s->esc_params[0] = 1; s->esc_params[0] = 1;
} }
s->x += s->esc_params[0]; set_cursor(s, s->x + s->esc_params[0], s->y);
if (s->x >= s->width) {
s->x = s->width - 1;
}
break; break;
case 'D': case 'D':
/* move cursor left */ /* move cursor left */
if (s->esc_params[0] == 0) { if (s->esc_params[0] == 0) {
s->esc_params[0] = 1; s->esc_params[0] = 1;
} }
s->x -= s->esc_params[0]; set_cursor(s, s->x - s->esc_params[0], s->y);
if (s->x < 0) {
s->x = 0;
}
break; break;
case 'G': case 'G':
/* move cursor to column */ /* move cursor to column */
s->x = s->esc_params[0] - 1; set_cursor(s, s->esc_params[0] - 1, s->y);
if (s->x < 0) {
s->x = 0;
}
break; break;
case 'f': case 'f':
case 'H': case 'H':
/* move cursor to row, column */ /* move cursor to row, column */
s->x = s->esc_params[1] - 1; set_cursor(s, s->esc_params[1] - 1, s->esc_params[0] - 1);
if (s->x < 0) {
s->x = 0;
}
s->y = s->esc_params[0] - 1;
if (s->y < 0) {
s->y = 0;
}
break; break;
case 'J': case 'J':
switch (s->esc_params[0]) { switch (s->esc_params[0]) {