From feeee4b5832b17641e505b7083e0d299fdae318e Mon Sep 17 00:00:00 2001 From: Christian Persch <chpe@gnome.org> Date: Sat, 19 May 2012 17:36:09 +0000 Subject: emulation: Limit integer arguments to 65535 To guard against malicious sequences containing excessively big numbers, limit all parsed numbers to 16 bit range. Doing this here in the parsing routine is a catch-all guard; this doesn't preclude enforcing more stringent limits in the handlers themselves. https://bugzilla.gnome.org/show_bug.cgi?id=676090 --- diff --git a/src/table.c b/src/table.c index 140e8c8..85cf631 100644 --- a/src/table.c +++ b/src/table.c @@ -550,7 +550,7 @@ _vte_table_extract_numbers(GValueArray **array, if (G_UNLIKELY (*array == NULL)) { *array = g_value_array_new(1); } - g_value_set_long(&value, total); + g_value_set_long(&value, CLAMP (total, 0, G_MAXUSHORT)); g_value_array_append(*array, &value); } while (i++ < arginfo->length); g_value_unset(&value); diff --git a/src/vteseq.c b/src/vteseq.c index 457c06a..46def5b 100644 --- a/src/vteseq.c +++ b/src/vteseq.c @@ -544,7 +544,7 @@ value = g_value_array_get_nth(params, 0); if (G_VALUE_HOLDS_LONG(value)) { val = g_value_get_long(value); - val = MAX(val, 1); /* FIXME: vttest. */ + val = CLAMP(val, 1, G_MAXUSHORT); /* FIXME: vttest. */ } } for (i = 0; i < val; i++) -- cgit v0.9.0.2