Skip to content

Commit

Permalink
Fixed size comparisons that could lead to infinite loops
Browse files Browse the repository at this point in the history
  • Loading branch information
javierdlg committed Jan 22, 2025
1 parent 51e21dd commit 70246ac
Show file tree
Hide file tree
Showing 3 changed files with 7 additions and 3 deletions.
4 changes: 3 additions & 1 deletion src/buffer/out/Row.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -433,7 +433,9 @@ OutputCellIterator ROW::WriteCells(OutputCellIterator it, const til::CoordType c
auto colorStarts = gsl::narrow_cast<uint16_t>(columnBegin);
auto currentIndex = colorStarts;

while (it && currentIndex <= finalColumnInRow)
// finalColumnInRow is 32-bit and currentIndex is 16-bit. If finalColumnInRow is higher
// than the 16-bit integer limit, we will loop indefinitely.
while (it && currentIndex <= saturated_cast<uint16_t>(finalColumnInRow))
{
// Fill the color if the behavior isn't set to keeping the current color.
if (it->TextAttrBehavior() != TextAttributeBehavior::Current)
Expand Down
4 changes: 3 additions & 1 deletion src/terminal/adapter/SixelParser.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -610,7 +610,9 @@ void SixelParser::_updateTextColors()
// the text output as well.
if (_conformanceLevel <= 3 && _maxColors > 2 && _colorTableChanged) [[unlikely]]
{
for (IndexType tableIndex = 0; tableIndex < _maxColors; tableIndex++)
// _maxColors is 64-bit and tableIndex is 8-bit. If _maxColors is higher
// than the 8-bit integer limit, we will loop indefinitely.
for (IndexType tableIndex = 0; tableIndex < (saturated_cast<uint8_t>(_maxColors)); tableIndex++)
{
_dispatcher.SetColorTableEntry(tableIndex, _colorFromIndex(tableIndex));
}
Expand Down
2 changes: 1 addition & 1 deletion src/terminal/adapter/charsets.hpp
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ namespace Microsoft::Console::VirtualTerminal
public:
constexpr CharSet(const std::initializer_list<std::pair<wchar_t, wchar_t>> replacements)
{
for (auto i = L'\0'; i < _translationTable.size(); i++)
for (size_t i = L'\0'; i < _translationTable.size(); i++)
_translationTable.at(i) = BaseChar + i;
for (auto replacement : replacements)
_translationTable.at(replacement.first - BaseChar) = replacement.second;
Expand Down

0 comments on commit 70246ac

Please sign in to comment.