From 7b856d628bfd6c775dfaee2138a3542ee13b1960 Mon Sep 17 00:00:00 2001 From: ailin-nemui Date: Thu, 15 Dec 2016 18:01:26 +0100 Subject: [PATCH 1/5] check for end of string in ansi 48 --- src/fe-common/core/formats.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/fe-common/core/formats.c b/src/fe-common/core/formats.c index a58d839a..a789c0e3 100644 --- a/src/fe-common/core/formats.c +++ b/src/fe-common/core/formats.c @@ -956,6 +956,7 @@ static const char *get_ansi_color(THEME_REC *theme, const char *str, str++; for (num2 = 0; i_isdigit(*str); str++) num2 = num2*10 + (*str-'0'); + if (*str == '\0') return start; switch (num2) { case 2: @@ -973,6 +974,8 @@ static const char *get_ansi_color(THEME_REC *theme, const char *str, for (; i_isdigit(*str); str++) num2 = (num2&~0xff) | (((num2&0xff) * 10 + (*str-'0'))&0xff); + + if (*str == '\0') return start; } if (i == -1) break; @@ -1001,6 +1004,7 @@ static const char *get_ansi_color(THEME_REC *theme, const char *str, str++; for (num2 = 0; i_isdigit(*str); str++) num2 = num2*10 + (*str-'0'); + if (*str == '\0') return start; if (num == 38) { flags &= ~GUI_PRINT_FLAG_COLOR_24_FG; From 77aab7905791823f6ce2c19b4aaacd4231324841 Mon Sep 17 00:00:00 2001 From: ailin-nemui Date: Mon, 19 Dec 2016 21:16:37 +0100 Subject: [PATCH 2/5] avoid server_disconnect Closes #4 --- src/irc/core/irc-nicklist.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/irc/core/irc-nicklist.c b/src/irc/core/irc-nicklist.c index b22f3269..1cb1f3e9 100644 --- a/src/irc/core/irc-nicklist.c +++ b/src/irc/core/irc-nicklist.c @@ -314,7 +314,11 @@ static void event_whois_ircop(SERVER_REC *server, const char *data) static void event_nick_invalid(IRC_SERVER_REC *server, const char *data) { if (!server->connected) - server_disconnect((SERVER_REC *) server); + /* we used to call server_disconnect but that crashes + irssi because of undefined memory access. instead, + indicate that the connection should be dropped and + let the irc method to the clean-up. */ + server->connection_lost = server->no_reconnect = TRUE; } static void event_nick_in_use(IRC_SERVER_REC *server, const char *data) From 508d2e0860992d6906b5a7b73017edbaa8c94d98 Mon Sep 17 00:00:00 2001 From: ailin-nemui Date: Mon, 19 Dec 2016 16:06:13 +0100 Subject: [PATCH 3/5] bail out if nick is NULL in irc_query_find Closes #1 --- src/irc/core/irc-queries.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/irc/core/irc-queries.c b/src/irc/core/irc-queries.c index 12861744..77a5289d 100644 --- a/src/irc/core/irc-queries.c +++ b/src/irc/core/irc-queries.c @@ -45,6 +45,8 @@ QUERY_REC *irc_query_find(IRC_SERVER_REC *server, const char *nick) { GSList *tmp; + g_return_val_if_fail(nick != NULL, NULL); + for (tmp = server->queries; tmp != NULL; tmp = tmp->next) { QUERY_REC *rec = tmp->data; From 8007e9e61d67044a6b29a266300a936e4c86fdd9 Mon Sep 17 00:00:00 2001 From: Joseph Bisch Date: Mon, 19 Dec 2016 09:31:38 -0500 Subject: [PATCH 4/5] Fix oob read on invalid utf8 in term_addstr --- src/fe-text/term-terminfo.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/fe-text/term-terminfo.c b/src/fe-text/term-terminfo.c index b2478c62..3098a4e4 100644 --- a/src/fe-text/term-terminfo.c +++ b/src/fe-text/term-terminfo.c @@ -539,9 +539,16 @@ int term_addstr(TERM_WINDOW *window, const char *str) if (term_type == TERM_TYPE_UTF8) { while (*ptr != '\0') { - tmp = g_utf8_get_char(ptr); - len += unichar_isprint(tmp) ? mk_wcwidth(tmp) : 1; - ptr = g_utf8_next_char(ptr); + tmp = g_utf8_get_char_validated(ptr, -1); + /* On utf8 error, treat as single byte and try to + continue interpretting rest of string as utf8 */ + if (tmp == (gunichar)-1 || tmp == (gunichar)-2) { + len++; + ptr++; + } else { + len += unichar_isprint(tmp) ? mk_wcwidth(tmp) : 1; + ptr = g_utf8_next_char(ptr); + } } } else len = raw_len; From 7dc2f832c19d8b5c682f5c9abd106ab6be53bf62 Mon Sep 17 00:00:00 2001 From: ailin-nemui Date: Tue, 20 Dec 2016 16:41:57 +0100 Subject: [PATCH 5/5] fix %[ --- src/fe-common/core/formats.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/fe-common/core/formats.c b/src/fe-common/core/formats.c index a58d839a..9ce9bce5 100644 --- a/src/fe-common/core/formats.c +++ b/src/fe-common/core/formats.c @@ -68,7 +68,7 @@ static void format_expand_code(const char **format, GString *out, int *flags) if (flags == NULL) { /* flags are being ignored - skip the code */ - while (**format != ']') + while (**format != ']' && **format != '\0') (*format)++; return; } @@ -246,6 +246,10 @@ int format_expand_styles(GString *out, const char **format, int *flags) case '[': /* code */ format_expand_code(format, out, flags); + if ((*format)[0] == '\0') + /* oops, reached end prematurely */ + (*format)--; + break; case 'x': case 'X':