1
0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-01-27 10:12:24 +00:00

ldisc_send: return early if len == 0.

This can come up, for example, if the terminal receives a ^E character
and has an empty answerback string configured.

Without this early return, we append zero bytes to ldisc's ordinary
bufchain input_queue, which is harmless; but we also append a
zero-length record to ldisc's list of (type, length) chunks describing
which parts of the input bufchain should be treated as interactive or
as coming from special dedicated keystrokes (e.g. telling Return apart
from ^M).

That zero-length record is not _immediately_ harmful, but when the
user next presses a key, it will have a different type from the empty
answerback data, so that another chunk record is appended to the list
after the zero-length one. And then ldisc_input_queue_callback goes
into a tight loop, because it keeps trying to consume bytes from the
start of the input bufchain but bounding the size at the length of the
first (type, length) chunk, which is zero. So it consumes 0 bytes,
finds the bufchain still isn't empty, and loops round again.
This commit is contained in:
Simon Tatham 2025-01-16 07:24:06 +00:00
parent e7acb9f696
commit 19798515df

View File

@ -272,8 +272,10 @@ void ldisc_send(Ldisc *ldisc, const void *vbuf, int len, bool interactive)
*/ */
len = strlen(vbuf); len = strlen(vbuf);
type = DEDICATED; type = DEDICATED;
} else { } else if (len > 0) {
type = interactive ? NORMAL : NONINTERACTIVE; type = interactive ? NORMAL : NONINTERACTIVE;
} else {
return; /* nothing to do anyway */
} }
/* /*