From 1e576cb1476a8fa5b4a87e90213ee961c4be91ca Mon Sep 17 00:00:00 2001 From: Nicolas Pitre Date: Sun, 24 Feb 2013 20:06:09 -0500 Subject: [PATCH] tty vt: fix character insertion overflow MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Commit 0ca3f3241815 ("tty vt: Fix line garbage in virtual console on command line edition") broke insert_char() in multiple ways. Then commit c04b153ae064 ("tty vt: Fix a regression in command line edition") partially fixed it. However, the buffer being moved is still too large and overflowing beyond the end of the current line, corrupting existing characters on the next line. Example test case: echo -e "abc\nde\x1b[A\x1b[4h \x1b[4l\x1b[B" Expected result: ab c de Current result: ab c e Needless to say that this is very annoying when inserting words in the middle of paragraphs with certain text editors. Signed-off-by: Nicolas Pitre Cc: Jean-François Moine Cc: Greg Kroah-Hartman Cc: Signed-off-by: Linus Torvalds --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 1a27280345999..6c4abeaf690fc 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -539,7 +539,7 @@ static void insert_char(struct vc_data *vc, unsigned int nr) { unsigned short *p = (unsigned short *) vc->vc_pos; - scr_memmovew(p + nr, p, (vc->vc_cols - vc->vc_x) * 2); + scr_memmovew(p + nr, p, (vc->vc_cols - vc->vc_x - nr) * 2); scr_memsetw(p, vc->vc_video_erase_char, nr * 2); vc->vc_need_wrap = 0; if (DO_UPDATE(vc)) -- 2.39.5