Buffer overflow in escape sequence handling

[iamDyeus]

The remember_escape() function will memcpy beyond buffer bounds when escape sequences exceed SMALLBUF.

memcpy(st->reset, st->escape, st->esclen);  // reads/writes past buffer

[torvalds]

esclen cannot be larger than SMALLBUF. It is initialized to 0, then set to 1 when entering the 'Escape' state, and then updated only with

    if (st->esclen < SMALLBUF)
            st->escape[st->esclen++] = c;

in handle_escape. So it ends up being at most SMALLBUF.