[vte/vte-next] emulation: Limit repetitions

[Christian Persch <chpe src gnome org>]

commit 4c627f99e103f5d95952e3a54391fc3a1692ad03
Author: Christian Persch <chpe gnome org>
Date:   Sat May 19 20:04:12 2012 +0200

    emulation: Limit repetitions
    
    Don't allow malicious sequences to cause excessive repetitions.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=676090
    (cherry picked from commit 98ce2f265f986fb88c38d508286bb5e3716b9e74)
    
    Conflicts:
    
    	src/vteseq.c

 src/vteseq.c |   26 +++++++++++++++++++-------
 1 files changed, 19 insertions(+), 7 deletions(-)
---
diff --git a/src/vteseq.c b/src/vteseq.c
index a1a18db..d201bcc 100644
--- a/src/vteseq.c
+++ b/src/vteseq.c
@@ -1318,7 +1318,7 @@ vte_sequence_handler_dc (VteBuffer *buffer, GValueArray *params)
 static void
 vte_sequence_handler_DC (VteBuffer *buffer, GValueArray *params)
 {
-	vte_sequence_handler_multiple(buffer, params, vte_sequence_handler_dc);
+	vte_sequence_handler_multiple_r(buffer, params, vte_sequence_handler_dc);
 }
 
 /* Delete a line at the current cursor position. */
@@ -1711,7 +1711,7 @@ vte_sequence_handler_reverse_index (VteBuffer *buffer, GValueArray *params)
 static void
 vte_sequence_handler_RI (VteBuffer *buffer, GValueArray *params)
 {
-	vte_sequence_handler_multiple(buffer, params, vte_sequence_handler_nd);
+	vte_sequence_handler_multiple_r(buffer, params, vte_sequence_handler_nd);
 }
 
 /* Save cursor (position). */
@@ -2699,9 +2699,9 @@ vte_sequence_handler_insert_lines (VteBuffer *buffer, GValueArray *params)
 {
 	GValue *value;
 	VteScreen *screen;
-	long param, end, row;
-	int i;
+	long param, end, row, i, limit;
 	screen = buffer->pvt->screen;
+
 	/* The default is one. */
 	param = 1;
 	/* Extract any parameters. */
@@ -2718,7 +2718,13 @@ vte_sequence_handler_insert_lines (VteBuffer *buffer, GValueArray *params)
 	} else {
 		end = screen->insert_delta + buffer->pvt->row_count - 1;
 	}
-	/* Insert the new lines at the cursor. */
+
+	/* Only allow to insert as many lines as there are between this row
+         * and the end of the scrolling region. See bug #676090.
+         */
+        limit = end - row + 1;
+        param = MIN (param, limit);
+
 	for (i = 0; i < param; i++) {
 		/* Clear a line off the end of the region and add one to the
 		 * top of the region. */
@@ -2739,8 +2745,7 @@ vte_sequence_handler_delete_lines (VteBuffer *buffer, GValueArray *params)
 {
 	GValue *value;
 	VteScreen *screen;
-	long param, end, row;
-	int i;
+	long param, end, row, i, limit;
 
 	screen = buffer->pvt->screen;
 	/* The default is one. */
@@ -2759,6 +2764,13 @@ vte_sequence_handler_delete_lines (VteBuffer *buffer, GValueArray *params)
 	} else {
 		end = screen->insert_delta + buffer->pvt->row_count - 1;
 	}
+
+        /* Only allow to delete as many lines as there are between this row
+         * and the end of the scrolling region. See bug #676090.
+         */
+        limit = end - row + 1;
+        param = MIN (param, limit);
+
 	/* Clear them from below the current cursor. */
 	for (i = 0; i < param; i++) {
 		/* Insert a line at the end of the region and remove one from