Foot Version
1.27.0
TERM environment variable
foot
Compositor Name and Version
sway 1.11
Distribution
arch
Terminal multiplexer
No response
Shell, TUI, application
No response
Server/standalone mode
- Standalone
- Server
Foot config
default
Description of Bug and Steps to Reproduce
osc.c kitty_text_size at line 1245-1246:
uint32_t key = composed_key_from_chars(wchars, len);
const struct composed *composed = composed_lookup_without_collision(
term->composed, &key, wchars, len - 1, wchars[len - 1], forced_width);
When the OSC 66 payload has the form w=N; with no text after the
semicolon, the parameter-only early-out at line 1196-1206 is taken
only when forced_width == 0; for w=1..7 it falls through. ambstoc32("")
returns a 4-byte allocation containing just U'0円' and c32len returns 0,
so the call above evaluates wchars[len - 1] with len - 1 = SIZE_MAX.
On 64-bit, wchars + SIZE_MAX * sizeof(char32_t) wraps and lands four
bytes before the allocation.
Reproduce:
printf '033円]66;w=1;033円\\'
AddressSanitizer:
AddressSanitizer: heap-buffer-overflow on address 0x50200000004c
READ of size 4 at 0x50200000004c thread T0
0x50200000004c is located 4 bytes before 4-byte region
SUMMARY: AddressSanitizer: heap-buffer-overflow in osc_dispatch
Fix: in kitty_text_size, treat len == 0 as the empty case and return
before computing len - 1 (or guard the lookup on len >= 1).
Relevant logs, stacktraces, etc.
No response
### Foot Version
1.27.0
### TERM environment variable
foot
### Compositor Name and Version
sway 1.11
### Distribution
arch
### Terminal multiplexer
_No response_
### Shell, TUI, application
_No response_
### Server/standalone mode
- [ ] Standalone
- [ ] Server
### Foot config
```ini
default
```
### Description of Bug and Steps to Reproduce
osc.c kitty_text_size at line 1245-1246:
uint32_t key = composed_key_from_chars(wchars, len);
const struct composed *composed = composed_lookup_without_collision(
term->composed, &key, wchars, len - 1, wchars[len - 1], forced_width);
When the OSC 66 payload has the form `w=N;` with no text after the
semicolon, the parameter-only early-out at line 1196-1206 is taken
only when forced_width == 0; for w=1..7 it falls through. ambstoc32("")
returns a 4-byte allocation containing just U'0円' and c32len returns 0,
so the call above evaluates `wchars[len - 1]` with `len - 1` = SIZE_MAX.
On 64-bit, `wchars + SIZE_MAX * sizeof(char32_t)` wraps and lands four
bytes before the allocation.
Reproduce:
printf '033円]66;w=1;033円\\'
AddressSanitizer:
AddressSanitizer: heap-buffer-overflow on address 0x50200000004c
READ of size 4 at 0x50200000004c thread T0
0x50200000004c is located 4 bytes before 4-byte region
SUMMARY: AddressSanitizer: heap-buffer-overflow in osc_dispatch
Fix: in kitty_text_size, treat len == 0 as the empty case and return
before computing `len - 1` (or guard the lookup on len >= 1).
### Relevant logs, stacktraces, etc.
_No response_