File xterm-CVE-2022-24130.patch of Package xterm.32862

From 24681da346c496f7fdf1ae227c7ae2656115d298 Mon Sep 17 00:00:00 2001
From: "Thomas E. Dickey" <dickey@invisible-island.net>
Date: Sun, 30 Jan 2022 19:31:01 +0000
Subject: [PATCH] snapshot of project "xterm", label xterm-370d

---
 graphics_sixel.c         | 26 +++++++----

Index: xterm-330/graphics_sixel.c
===================================================================
--- xterm-330.orig/graphics_sixel.c
+++ xterm-330/graphics_sixel.c
@@ -141,7 +141,11 @@ init_sixel_background(Graphic *graphic,
     graphic->color_registers_used[context->background] = 1;
 }
 
-static void
+#define ValidColumn(graphic, context) \
+        ((context)->col >= 0 && \
+         (context)->col < (graphic)->max_width)
+
+static Boolean
 set_sixel(Graphic *graphic, SixelContext const *context, int sixel)
 {
     const int mh = graphic->max_height;
@@ -175,8 +179,10 @@ set_sixel(Graphic *graphic, SixelContext
 	    }
 	} else {
 	    TRACE(("sixel pixel %d out of bounds\n", pix));
+	    return False;
 	}
     }
+    return True;
 }
 
 static void
@@ -451,7 +457,13 @@ parse_sixel(XtermWidget xw, ANSI *params
 		init_sixel_background(graphic, &context);
 		graphic->valid = 1;
 	    }
-	    set_sixel(graphic, &context, sixel);
+	    if (sixel) {
+                if (!ValidColumn(graphic, &context) ||
+                    !set_sixel(graphic, &context, sixel)) {
+                    context.col = 0;
+                    break;
+                }
+	    }
 	    context.col++;
 	} else if (ch == '$') {	/* DECGCR */
 	    /* ignore DECCRNLM in sixel mode */
@@ -529,8 +541,13 @@ parse_sixel(XtermWidget xw, ANSI *params
 		graphic->valid = 1;
 	    }
 	    for (i = 0; i < Pcount; i++) {
-		set_sixel(graphic, &context, sixel);
-		context.col++;
+		if (ValidColumn(graphic, &context) &&
+			set_sixel(graphic, &context, sixel)) {
+			context.col++;
+		} else {
+			context.col = 0;
+			break;
+		}
 	    }
 	} else if (ch == '#') {	/* DECGCI */
 	    ANSI color_params;