Skip to content

Fix a OOB write in SixelParser#20153

Closed
lhecker wants to merge 2 commits into
mainfrom
dev/lhecker/20149-hotfix
Closed

Fix a OOB write in SixelParser#20153
lhecker wants to merge 2 commits into
mainfrom
dev/lhecker/20149-hotfix

Conversation

@lhecker
Copy link
Copy Markdown
Member

@lhecker lhecker commented Apr 28, 2026

The SixelParser state machine assumes that _resizeImageBuffer
succeeded. The state that determines the X/Y size of the buffer
is set outside of the resize function.
This meant that an OOM failure can cause the resize to fail
and the buffer X/Y size variables to be out-of-sync.
A later write in the buffer will then be out of bounds.
Whether that's before or after the buffer address depends
on whether the 32-bit coord multiplication overflows or not.

Closes #20149

Validation Steps Performed

  • Run the repro (super tall sixel), specifically
    in PowerShell 5 (depends on its particular chunking)
  • OpenConsole.exe doesn't crash

Comment thread src/terminal/adapter/SixelParser.cpp Dismissed
Comment thread src/terminal/adapter/SixelParser.cpp Dismissed
Comment thread src/terminal/adapter/SixelParser.cpp Dismissed
Comment thread src/terminal/adapter/SixelParser.cpp Dismissed
@j4james
Copy link
Copy Markdown
Collaborator

j4james commented Apr 28, 2026

Would it not be simpler to catch the out of memory exception in the handler here, and then return false?

return [&](const auto ch) {
_parseCommandChar(ch);
return true;
};

I believe that should tell the state machine to ignore all further content in the sequence, so there should be no chance of the buffer being used after that.

And while dealing with the OOM exception is a good thing either way, I'd prefer it if you also implemented the patch I posted in #20149 (comment), because this particular case should never have used that much memory in the first place - that's the real bug that #20149 identified. If you don't want to address that in this PR, at least leave the issue open.

@lhecker
Copy link
Copy Markdown
Member Author

lhecker commented Apr 28, 2026

Would it not be simpler to catch the out of memory exception in the handler here, and then return false?

omg I completely forgot about this behavior of our parser! I wonder why this didn't occur to me...

And while dealing with the OOM exception is a good thing either way, I'd prefer it if you also implemented the patch I posted [...]

I intended to file a follow-up issue. But given that your suggested fix is a lot tidier than mine, I'll simply piggy-back your proper fix here. Thank you for the feedback!

@DHowett DHowett closed this in c829d4c May 12, 2026
DHowett added a commit that referenced this pull request May 12, 2026
…20213)

This commit implements two fixes for the integer overflow/out-of-bounds
write reported in #20149.

First, it catches any exception generated in sixel char processing
(which will prevent `out_of_memory` or `bad_alloc` from being ignored
sight-unseen, and will prevent the consumption of further DCS content).

Second, it prevents us from allocating memory for an image which will
never be displayed (because it exceeds the height of the display.)

This supersedes prior work in #20153 for the same issues.

Closes #20149
Closes #20153

Co-authored-by: James Holderness <j4_james@hotmail.com>
(cherry picked from commit c829d4c)
Service-Card-Id: PVTI_lADOAF3p4s4BBcTlzgrY_zM
Service-Version: 1.24
DHowett added a commit that referenced this pull request May 12, 2026
…20213)

This commit implements two fixes for the integer overflow/out-of-bounds
write reported in #20149.

First, it catches any exception generated in sixel char processing
(which will prevent `out_of_memory` or `bad_alloc` from being ignored
sight-unseen, and will prevent the consumption of further DCS content).

Second, it prevents us from allocating memory for an image which will
never be displayed (because it exceeds the height of the display.)

This supersedes prior work in #20153 for the same issues.

Closes #20149
Closes #20153

Co-authored-by: James Holderness <j4_james@hotmail.com>
(cherry picked from commit c829d4c)
Service-Card-Id: PVTI_lADOAF3p4s4BQX0-zgrY_zQ
Service-Version: 1.25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[SECURITY] Potential Out-of-Bounds Write in Windows Terminal OpenConsole SIXEL Parser via Integer Overflow

3 participants