Buffer Overflow on screen.c

[Thiago4532]

This PR closes the issue #6306.

There is a buffer overflow on the function screen_dirty_line_graphics.

This function loops from [top, bottom] inclusive, but the function screen_erase_in_display calls screen_dirty_line_graphics for the range [cursor, num_lines], causing a buffer overflow on linebuf->line_attrs.

Checking the value of how before calling the functions solves the issue, the other calls to screen_dirty_line_graphics seems fine.

[Thiago4532]

I made a mistake on the previous fix, now it should be good!

[kovidgoyal]

On Sat, May 27, 2023 at 11:20:00AM -0700, Thiago Mota Martins wrote: I am thinking about refactoring the function 'screen_erase_in_display' to prevent', the variables `a` and `b` are somewhat confusing, at least for me. Are you okay with Pull Requests to refactor the code? Or should I open an issue to have a discussion about refactoring?

I am fine with PRs to refactor code, I cant guarantee all such PRs would be merged, of course. In this case a and b are simply the limits over which the clearing operates. If you prefer other names for them, I dont mind.

[kovidgoyal]

On Sat, May 27, 2023 at 03:11:03PM -0700, Thiago Mota Martins wrote: I made a mistake on the previous fix, now it should be good!

I fixed it slightly differently, making sure the loop in screen_dirty_line_graphics() is always over a valid range.

[Thiago4532]

I thought about that too! Happy that was fixed! The glitches on my terminal were so annoying, thanks! :)

[kovidgoyal]

Thanks for tracking down the issue, saved me some time and headache.