Fix crash when a too-large cursor shape number is passed to SetCursorShape escape sequence

gnachman · gnachman · commit 5ac600a5ccc8 · 2016-05-02T21:17:40.000-07:00
diff --git a/sources/VT100Terminal.m b/sources/VT100Terminal.m
@@ -2044,7 +2044,7 @@ - (void)executeXtermSetKvp:(VT100Token *)token {
         // Value must be an integer. Bogusly, non-numbers are treated as 0.
         int shape = [value intValue];
         ITermCursorType shapeMap[] = { CURSOR_BOX, CURSOR_VERTICAL, CURSOR_UNDERLINE };
-        if (shape >= 0 && shape < sizeof(shapeMap)/sizeof(int)) {
+        if (shape >= 0 && shape < sizeof(shapeMap)/sizeof(*shapeMap)) {
             [delegate_ terminalSetCursorType:shapeMap[shape]];
         }
     } else if ([key isEqualToString:@"ShellIntegrationVersion"]) {

Original file line number	Diff line number	Diff line change
`@@ -2044,7 +2044,7 @@ - (void)executeXtermSetKvp:(VT100Token *)token {`
`2044`	`2044`	`// Value must be an integer. Bogusly, non-numbers are treated as 0.`
`2045`	`2045`	`int shape = [value intValue];`
`2046`	`2046`	`ITermCursorType shapeMap[] = { CURSOR_BOX, CURSOR_VERTICAL, CURSOR_UNDERLINE };`
`2047`		`- if (shape >= 0 && shape < sizeof(shapeMap)/sizeof(int)) {`
	`2047`	`+ if (shape >= 0 && shape < sizeof(shapeMap)/sizeof(*shapeMap)) {`
`2048`	`2048`	`[delegate_ terminalSetCursorType:shapeMap[shape]];`
`2049`	`2049`	`}`
`2050`	`2050`	`} else if ([key isEqualToString:@"ShellIntegrationVersion"]) {`