git: c6d7be214811 - main - tty: properly check character position when handling IUTF8 backspaces

[Christos Margiolis]

The branch main has been updated by christos:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=c6d7be214811c315d234d64c6cbaa92d4f55d2c1

commit c6d7be214811c315d234d64c6cbaa92d4f55d2c1
Author:     Bojan Novković <bojan.novko...@fer.hr>
AuthorDate: 2023-11-13 18:02:30 +0000
Commit:     Christos Margiolis <chris...@freebsd.org>
CommitDate: 2023-11-13 18:04:11 +0000

    tty: properly check character position when handling IUTF8 backspaces
    
    The tty_rubchar() code handling backspaces for UTF-8 characters didn't
    properly check whether the beginning of the current line was reached.
    This resulted in a kernel panic in ttyinq_unputchar() when prodded with
    certain malformed UTF-8 sequences.
    
    Fixes:          PR 275009
    Reviewed by:    christos
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D42564
---
 sys/kern/tty_ttydisc.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sys/kern/tty_ttydisc.c b/sys/kern/tty_ttydisc.c
index c46579cefbb1..cb5bf672d040 100644
--- a/sys/kern/tty_ttydisc.c
+++ b/sys/kern/tty_ttydisc.c
@@ -822,7 +822,13 @@ ttydisc_rubchar(struct tty *tp)
                                /* Loop back through inq until we hit the
                                 * leading byte. */
                                while (CTL_UTF8_CONT(c) && nb < UTF8_STACKBUF) {
-                                       ttyinq_peekchar(&tp->t_inq, &c, &quote);
+                                       /*
+                                        * Check if we've reached the beginning
+                                        * of the line.
+                                        */
+                                       if (ttyinq_peekchar(&tp->t_inq, &c,
+                                           &quote) != 0)
+                                               break;
                                        ttyinq_unputchar(&tp->t_inq);
                                        bytes[curidx] = c;
                                        curidx--;