From de4b203da90b3a2a85df0ffa35cc8bd461199894 Mon Sep 17 00:00:00 2001
From: Mark Edgar <medgar123@gmail.com>
Date: Wed, 2 Oct 2013 09:23:54 +0200
Subject: [PATCH] Avoid buffer overrun in kpress().

---
 st.c | 41 ++++++++++++++++++++++-------------------
 1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/st.c b/st.c
index c3a04c5..ad395ee 100644
--- a/st.c
+++ b/st.c
@@ -251,7 +251,7 @@ typedef struct {
 typedef struct {
 	KeySym k;
 	uint mask;
-	char s[ESC_BUF_SIZ];
+	char *s;
 	/* three valued logic variables: 0 indifferent, 1 on, -1 off */
 	signed char appkey;    /* application keypad */
 	signed char appcursor; /* application cursor */
@@ -3546,29 +3546,32 @@ kpress(XEvent *ev) {
 	/* 2. custom keys from config.h */
 	if((customkey = kmap(ksym, e->state))) {
 		len = strlen(customkey);
-		memcpy(buf, customkey, len);
-	/* 3. hardcoded (overrides X lookup) */
-	} else {
-		if(len == 0)
-			return;
+		ttywrite(customkey, len);
+		if(IS_SET(MODE_ECHO))
+			techo(customkey, len);
+		return;
+	}
 
-		if(len == 1 && e->state & Mod1Mask) {
-			if(IS_SET(MODE_8BIT)) {
-				if(*xstr < 0177) {
-					c = *xstr | 0x80;
-					ret = utf8encode(&c, cp);
-					cp += ret;
-					len = 0;
-				}
-			} else {
-				*cp++ = '\033';
+	if(len == 0)
+		return;
+
+	/* 3. hardcoded (overrides X lookup) */
+	if(len == 1 && e->state & Mod1Mask) {
+		if(IS_SET(MODE_8BIT)) {
+			if(*xstr < 0177) {
+				c = *xstr | 0x80;
+				ret = utf8encode(&c, cp);
+				cp += ret;
+				len = 0;
 			}
+		} else {
+			*cp++ = '\033';
 		}
-
-		memcpy(cp, xstr, len);
-		len = cp - buf + len;
 	}
 
+	memcpy(cp, xstr, len);
+	len = cp - buf + len;
+
 	ttywrite(buf, len);
 	if(IS_SET(MODE_ECHO))
 		techo(buf, len);
-- 
1.8.4