Go to file
Avi Halachmi (:avih) ea4d933ed9 base64dec: don't read out of bounds
Previously, base64dec checked terminating input '\0' every 4 calls to
base64dec_getc, where the latter progressed one or more chars on each
call, and could read past '\0' in the way it was used.

The input to base64dec currently comes only from OSC 52 escape seq
(copy to clipboard), and reading past '\0' or even past the buffer
boundary was easy to trigger.

Also, even if we could trust external input to be valid base64, there
are different base64 standards, and not all of them require padding
to 4 bytes blocks (using trailing '=' chars).

It didn't affect short OSC 52 strings because the buffer is initialized
to 0's, so typically it did stop within the buffer, but if the string
was trimmed to fit (the buffer is 512 bytes) then it did also read past
the end of the buffer, and the decoded suffix ended up arbitrary.

This patch makes base64dec_getc not progress past '\0', and instead
produce fake trailing padding of '='.

Additionally, at base64dec, if padding is detected at the first or
second byte of a quartet, then we identify it as invalid and abort
(a valid quartet has at least two leading non-padding bytes).
2019-11-10 22:45:54 +01:00
FAQ FAQ: add entry about color emoji Xft bug 2019-05-17 13:00:10 +02:00
LEGACY LEGACY: typo. 2012-09-18 19:08:03 +02:00
LICENSE LICENSE: fix a few years 2018-03-14 20:08:00 +01:00
Makefile Makefile: fix dependencies on config.h 2019-01-04 12:33:01 +01:00
README tic -s -> tic -sx (Treat unknown capabilities as user-defined.) 2016-11-14 19:05:47 +01:00
TODO Remove old TODO entry. 2015-04-13 17:06:11 +02:00
arg.h don't modify argv, use a counter 2018-03-20 21:22:27 +01:00
config.def.h mouse shortcuts: don't hardcode selpaste 2019-10-13 21:46:31 +02:00
config.mk bump version to 0.8.2 2019-02-09 12:48:39 +01:00
st.1 Remove the ISO 14755 feature 2018-09-11 19:05:55 +02:00
st.c base64dec: don't read out of bounds 2019-11-10 22:45:54 +01:00
st.h mouse shortcuts: allow same functions as kb shortcuts 2019-10-13 21:46:31 +02:00
st.info Fix tmux terminfo extensions Se and Ss 2019-11-05 19:51:35 +01:00
win.h better Input Method Editor (IME) support 2019-02-12 18:45:15 +01:00
x.c apply hints before initial mapping (ICCCM) 2019-10-26 11:47:24 +02:00

README

st - simple terminal
--------------------
st is a simple terminal emulator for X which sucks less.


Requirements
------------
In order to build st you need the Xlib header files.


Installation
------------
Edit config.mk to match your local setup (st is installed into
the /usr/local namespace by default).

Afterwards enter the following command to build and install st (if
necessary as root):

    make clean install


Running st
----------
If you did not install st with make clean install, you must compile
the st terminfo entry with the following command:

    tic -sx st.info

See the man page for additional details.

Credits
-------
Based on Aurélien APTEL <aurelien dot aptel at gmail dot com> bt source code.