[Qemu-devel] [PATCH] TextConsole: saturate escape parameter in TTY_STATE_CSI

[Qemu-devel] [PATCH] TextConsole: saturate escape parameter in TTY_STATE_CSI

[Laszlo Ersek]

Signed-off-by: Laszlo Ersek <lersek@redhat.com>
---
 Build tested.
 console.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/console.c b/console.c
index c1ed5e0..67080f4 100644
--- a/console.c
+++ b/console.c
@@ -938,8 +938,11 @@ static void console_putchar(TextConsole *s, int ch)
     case TTY_STATE_CSI: /* handle escape sequence parameters */
         if (ch >= '0' && ch <= '9') {
             if (s->nb_esc_params < MAX_ESC_PARAMS) {
-                s->esc_params[s->nb_esc_params] =
-                    s->esc_params[s->nb_esc_params] * 10 + ch - '0';
+                int *param = &s->esc_params[s->nb_esc_params];
+                int digit = (ch - '0');
+
+                *param = (*param <= (INT_MAX - digit) / 10) ?
+                         *param * 10 + digit : INT_MAX;
             }
         } else {
             if (s->nb_esc_params < MAX_ESC_PARAMS)
-- 
1.7.1

Re: [Qemu-devel] [PATCH] TextConsole: saturate escape parameter in TTY_STATE_CSI

[Markus Armbruster]

Laszlo Ersek <lersek@redhat.com> writes:

> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> ---
>  Build tested.
>  console.c |    7 +++++--
>  1 files changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/console.c b/console.c
> index c1ed5e0..67080f4 100644
> --- a/console.c
> +++ b/console.c
> @@ -938,8 +938,11 @@ static void console_putchar(TextConsole *s, int ch)
>      case TTY_STATE_CSI: /* handle escape sequence parameters */
>          if (ch >= '0' && ch <= '9') {
>              if (s->nb_esc_params < MAX_ESC_PARAMS) {
> -                s->esc_params[s->nb_esc_params] =
> -                    s->esc_params[s->nb_esc_params] * 10 + ch - '0';
> +                int *param = &s->esc_params[s->nb_esc_params];
> +                int digit = (ch - '0');
> +
> +                *param = (*param <= (INT_MAX - digit) / 10) ?
> +                         *param * 10 + digit : INT_MAX;
>              }
>          } else {
>              if (s->nb_esc_params < MAX_ESC_PARAMS)

Before this patch, silent integer overflow.  Exact behavior depends on
hosts int type.  For instance, \e[4294967296 is the same as \e[0 with 32
bit int, but with 64 bit int.

What does a real vt100 do?  I don't have one anymore.  For what it's
worth, both xterm and Xfce Terminal appear to saturate at some "big"
number ("big" compared to the argument values that are actually useful;
INT_MAX should do fine).  In particular, \e[4294967296 does *not* behave
like \e[0.

Therefore, changing QEMU to saturate makes sense.

Reviewed-by: Markus Armbruster <armbru@redhat.com>

Re: [Qemu-devel] [Qemu-trivial] [PATCH] TextConsole: saturate escape parameter in TTY_STATE_CSI

[Stefan Hajnoczi]

On Mon, Sep 17, 2012 at 11:10:03AM +0200, Laszlo Ersek wrote:
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> ---
>  Build tested.
>  console.c |    7 +++++--
>  1 files changed, 5 insertions(+), 2 deletions(-)

Thanks, applied to the trivial patches tree:
https://github.com/stefanha/qemu/commits/trivial-patches

Stefan