aboutsummaryrefslogtreecommitdiffstats
path: root/com32/elflink/ldlinux
diff options
context:
space:
mode:
authorRaphael S.Carvalho <raphael.scarv@gmail.com>2013-09-17 16:48:58 -0300
committerMatt Fleming <matt.fleming@intel.com>2013-09-30 15:43:36 +0100
commit639d33bcac11fd2d4db0668e8455d5086a4e48f1 (patch)
tree559a118981a3633ceaf096968f38c9d232627eae /com32/elflink/ldlinux
parentd31cfe6dfea7ab834289439ff4213155752cac99 (diff)
downloadsyslinux-639d33bcac11fd2d4db0668e8455d5086a4e48f1.tar.gz
syslinux-639d33bcac11fd2d4db0668e8455d5086a4e48f1.tar.xz
syslinux-639d33bcac11fd2d4db0668e8455d5086a4e48f1.zip
com32: Fix bugs on cmd_reverse_search (Triple fault dimension)
cmd_reverse_search has a bug that the variable cursor is updated even if a command wasn't found. If this happens, and the next key falls into the default case, memmove's size parameter would be a negative number. This bug can be reproduced by doing the following: On cmd_reverse_search (ctrl-r), type multiple keys at the same time. 'Enjoy' the triple fault and a screen of random colors. There is also a small bug that turns the task of using (ctrl-r) on the first command impossible. Previously, this command was discarded. Signed-off-by: Raphael S.Carvalho <raphael.scarv@gmail.com> Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Diffstat (limited to 'com32/elflink/ldlinux')
-rw-r--r--com32/elflink/ldlinux/cli.c11
1 files changed, 9 insertions, 2 deletions
diff --git a/com32/elflink/ldlinux/cli.c b/com32/elflink/ldlinux/cli.c
index 7c4f14c6..a50124c3 100644
--- a/com32/elflink/ldlinux/cli.c
+++ b/com32/elflink/ldlinux/cli.c
@@ -89,10 +89,14 @@ static const char * cmd_reverse_search(int *cursor, clock_t *kbd_to,
break;
}
- while (!list_is_last(&last_found->list, &cli_history_head)) {
+ while (last_found) {
p = strstr(last_found->command, buf);
if (p)
break;
+
+ if (list_is_last(&last_found->list, &cli_history_head))
+ break;
+
last_found = list_entry(last_found->list.next, typeof(*last_found), list);
}
@@ -391,7 +395,7 @@ const char *edit_cmdline(const char *input, int top /*, int width */ ,
len = strlen(cmdline);
} else {
cmdline[0] = '\0';
- len = 0;
+ cursor = len = 0;
}
redraw = 1;
}
@@ -441,6 +445,9 @@ const char *edit_cmdline(const char *input, int top /*, int width */ ,
}
prev_len++;
} else {
+ if (cursor > len)
+ return NULL;
+
memmove(cmdline + cursor + 1, cmdline + cursor,
len - cursor + 1);
cmdline[cursor++] = key;