[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Bug in libedit



In tty.c in libedit, the function tty_bind_char() has a bug.  Line 759
should be changed from:

   char new[2], old[2];

to:

   unsigned char new[2], old[2]; 

This is because new[] and old[] are used as an index to a command
array, and gets assignments from an unsigned char.  When 255 gets
assigned to them, it gets converted to -1 which is out of bounds.

This leads to a segfault when trying to exit the test program test.c
included with libedit.  If I can be any further assistance with this
bug, please to not hesitate to ask. 

Regards,

Jason Waterman



Visit your host, monkey.org