aboutsummaryrefslogtreecommitdiff
path: root/vis-single.c
diff options
context:
space:
mode:
authorRandy Palamar <randy@rnpnr.xyz>2025-12-16 10:56:01 -0700
committerRandy Palamar <randy@rnpnr.xyz>2025-12-16 11:19:28 -0700
commit3aa3501aa6d93e96653eb8e8c3662f724d3090ce (patch)
treec000bed1950463a1306880913182c8d90fb24187 /vis-single.c
parent992804cb27993d5de8e6830a8ab9268045ce6892 (diff)
downloadvis-3aa3501aa6d93e96653eb8e8c3662f724d3090ce.tar.gz
vis-3aa3501aa6d93e96653eb8e8c3662f724d3090ce.tar.xz
text-iterator: fix one byte over-read in codepoint iterator
Reported by @kyx0r here: https://github.com/kyx0r/nextvi/issues/189#issuecomment-3650406932 The crash is relatively hard to reproduce as it relies on there being no padding after the end of the memory allocation. This can only happen if the text size is an exact multiple of the system page size. In the linked backtrace it->start = 0x7ffff0e00000 and it->end = 0x7ffff7200000 (page size was likely 4K or 0x1000) so it->end, which is one past the last byte of the text, was pointing to an entirely different page. Dereferencing it can cause a segfault. If it doesn't segfault it is still incorrect to read beyond the end of the text even if it happens to work due to padding. The underlying text_iterator_byte_{next,prev}() functions were already handling this correctly. The fix is to not throw away their work.
Diffstat (limited to 'vis-single.c')
0 files changed, 0 insertions, 0 deletions