Heap-buffer-overflow in sixel_add_many_generic / sixel_add_many_ar_11 #2372

jackoftrade commented 2026年05月25日 23:41:44 +02:00

Foot Version

1.27.0

TERM environment variable

foot

Compositor Name and Version

sway 1.11

Distribution

arch

Terminal multiplexer

No response

Shell, TUI, application

No response

Server/standalone mode

• Standalone
• Server

Foot config

default

Description of Bug and Steps to Reproduce

sixel.c:1708 and identically 1766:

if (unlikely(col + count - 1 >= width)) {
 resize_horizontally(term, col + count);
 count = min(count, max(width - col, 0));
 if (count == 0) return;
}
uint32_t *end = data + count;
for (; data < end; data++) ...

count is unsigned, col is int. The check runs unsigned. A DECGRI
repeat count where (col + count) wraps mod 2^32 to <= width passes
the check, skipping resize and clamp; data + count then runs off the
end of the image buffer and the loop writes past it.

PoC (31 bytes):

printf '033円Pq"2;0;200;200@@!4294967295@033円\\' | foot

Result: out-of-bounds write 4 bytes past the sixel image buffer.

Fix: do the comparison in 64-bit; clamp count by (width - col) before
the loop.

Note that this may already be addressed by one of the patches for the related issues.

Relevant logs, stacktraces, etc.

No response

### Foot Version 1.27.0 ### TERM environment variable foot ### Compositor Name and Version sway 1.11 ### Distribution arch ### Terminal multiplexer _No response_ ### Shell, TUI, application _No response_ ### Server/standalone mode - [ ] Standalone - [ ] Server ### Foot config ```ini default ``` ### Description of Bug and Steps to Reproduce sixel.c:1708 and identically 1766: if (unlikely(col + count - 1 >= width)) { resize_horizontally(term, col + count); count = min(count, max(width - col, 0)); if (count == 0) return; } uint32_t *end = data + count; for (; data < end; data++) ... count is unsigned, col is int. The check runs unsigned. A DECGRI repeat count where (col + count) wraps mod 2^32 to <= width passes the check, skipping resize and clamp; data + count then runs off the end of the image buffer and the loop writes past it. PoC (31 bytes): printf '033円Pq"2;0;200;200@@!4294967295@033円\\' | foot Result: out-of-bounds write 4 bytes past the sixel image buffer. Fix: do the comparison in 64-bit; clamp count by (width - col) before the loop. Note that this may already be addressed by one of the patches for the related issues. ### Relevant logs, stacktraces, etc. _No response_