nano

commit fae5f823e15a6682f50f03ea615fd829fb75f31f
parent bdf8e41a72d8754bcce0c4998a65029f5a8459be
Author: Benno Schulenberg <bensberg@telfort.nl>
Date:   Sun, 12 Dec 2021 15:43:15 +0100

input: ensure that no more bytes are consumed than are available

The value of 'consumed' may not exceed the given 'length'.

Bug existed since version 2.9.3, commit e739448c.

(Bug was found by studying Fedora crash reports.  Thank you, Fedora!)

Diffstat:
M
src/winio.c
 | 
3
++-

1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/winio.c b/src/winio.c
@@ -507,8 +507,9 @@ int convert_SS3_sequence(const int *seq, size_t length, int *consumed)
 /* Translate a sequence that began with "Esc [" to its corresponding key code. */
 int convert_CSI_sequence(const int *seq, size_t length, int *consumed)
 {
-	if (seq[0] < '9')
+	if (seq[0] < '9' && length > 1)
 		*consumed = 2;
+
 	switch (seq[0]) {
 		case '1':
 			if (length > 1 && seq[1] == '~')