diff mbox

[10/14] TextConsole: saturate escape parameter in TTY_STATE_CSI

Message ID 1348394420-28298-11-git-send-email-stefanha@gmail.com
State New
Headers show

Commit Message

Stefan Hajnoczi Sept. 23, 2012, 10 a.m. UTC 
From: Laszlo Ersek <lersek@redhat.com>

Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
---
 console.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
diff mbox

Patch

diff --git a/console.c b/console.c
index a8bcc42..3f3d254 100644
--- a/console.c
+++ b/console.c
@@ -938,8 +938,11 @@  static void console_putchar(TextConsole *s, int ch)
     case TTY_STATE_CSI: /* handle escape sequence parameters */
         if (ch >= '0' && ch <= '9') {
             if (s->nb_esc_params < MAX_ESC_PARAMS) {
-                s->esc_params[s->nb_esc_params] =
-                    s->esc_params[s->nb_esc_params] * 10 + ch - '0';
+                int *param = &s->esc_params[s->nb_esc_params];
+                int digit = (ch - '0');
+
+                *param = (*param <= (INT_MAX - digit) / 10) ?
+                         *param * 10 + digit : INT_MAX;
             }
         } else {
             if (s->nb_esc_params < MAX_ESC_PARAMS)