From a868bacb46e3c900530bed47a1c6f85b0fbe701c Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Thu, 29 Oct 2020 16:33:01 +0000
Subject: [PATCH] Do not write after the end of the array and overwrite the
 stack when colon-separated SGR sequences contain empty arguments. Reported by
 Sergey Nizovtsev.

[Peter: Fixes CVE-2020-27347]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 input.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/input.c b/input.c
index 42a60c92..c280c0d9 100644
--- a/input.c
+++ b/input.c
@@ -1976,8 +1976,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
 				free(copy);
 				return;
 			}
-		} else
+		} else {
 			n++;
+			if (n == nitems(p)) {
+				free(copy);
+				return;
+			}
+		}
 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
 	}
 	free(copy);
-- 
2.20.1