Commit a883b70d authored by Nicolas Pitre's avatar Nicolas Pitre Committed by Linus Torvalds

tty vt: fix character insertion overflow

Commit 81732c3b ("tty vt: Fix line garbage in virtual console on
command line edition") broke insert_char() in multiple ways.  Then
commit b1a925f4 ("tty vt: Fix a regression in command line edition")
partially fixed it.  However, the buffer being moved is still too large
and overflowing beyond the end of the current line, corrupting existing
characters on the next line.

Example test case:

echo -e "abc\nde\x1b[A\x1b[4h \x1b[4l\x1b[B"

Expected result:

ab c
de

Current result:

ab c
 e

Needless to say that this is very annoying when inserting words in the
middle of paragraphs with certain text editors.
Signed-off-by: default avatarNicolas Pitre <nico@linaro.org>
Cc: Jean-François Moine <moinejf@free.fr>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 77be36de
...@@ -539,7 +539,7 @@ static void insert_char(struct vc_data *vc, unsigned int nr) ...@@ -539,7 +539,7 @@ static void insert_char(struct vc_data *vc, unsigned int nr)
{ {
unsigned short *p = (unsigned short *) vc->vc_pos; unsigned short *p = (unsigned short *) vc->vc_pos;
scr_memmovew(p + nr, p, (vc->vc_cols - vc->vc_x) * 2); scr_memmovew(p + nr, p, (vc->vc_cols - vc->vc_x - nr) * 2);
scr_memsetw(p, vc->vc_video_erase_char, nr * 2); scr_memsetw(p, vc->vc_video_erase_char, nr * 2);
vc->vc_need_wrap = 0; vc->vc_need_wrap = 0;
if (DO_UPDATE(vc)) if (DO_UPDATE(vc))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment