MFC r286798 and r286827:

  Stop parsing digits if the value already exceeds UINT_MAX / 100.

  There is no need for us to support parsing values that are larger than
  the maximum terminal window size. In this case that would be the maximum
  of unsigned short.

  The problem with parsing larger values is that they can cause integer
  overflows when adjusting the cursor position, leading to all sorts of
  failing assertions.

MFC r286981 and r287098:

  Don't truncate cursor arithmetic to 16 bits.

  When updating the row number when the cursor position escape sequence is
  issued, we should make sure to store the intermediate result in a 32-bit
  integer. If we fail to do this, the cursor may be set above the origin
  region, which is bad.

  This could cause libteken to crash when INVARIANTS is enabled, due to
  the strict set of assertions that libteken has.

PR:		202326, 202540, 202612
Submitted by:	kwcu csie org

2 files changed, 29 insertions, 21 deletions

diff --git a/sys/teken/teken.c b/sys/teken/teken.c
index 3002a88..8834390 100644
--- a/sys/teken/teken.c
+++ b/sys/teken/teken.c
@@ -29,12 +29,14 @@
 #include <sys/cdefs.h>
 #if defined(__FreeBSD__) && defined(_KERNEL)
 #include <sys/param.h>
+#include <sys/limits.h>
 #include <sys/lock.h>
 #include <sys/systm.h>
 #define	teken_assert(x)		MPASS(x)
 #else /* !(__FreeBSD__ && _KERNEL) */
 #include <sys/types.h>
 #include <assert.h>
+#include <limits.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <string.h>
@@ -405,18 +407,24 @@ teken_state_numbers(teken_t *t, teken_char_t c)
 	teken_assert(t->t_curnum < T_NUMSIZE);
 
 	if (c >= '0' && c <= '9') {
-		/*
-		 * Don't do math with the default value of 1 when a
-		 * custom number is inserted.
-		 */
 		if (t->t_stateflags & TS_FIRSTDIGIT) {
+			/* First digit. */
 			t->t_stateflags &= ~TS_FIRSTDIGIT;
-			t->t_nums[t->t_curnum] = 0;
-		} else {
-			t->t_nums[t->t_curnum] *= 10;
+			t->t_nums[t->t_curnum] = c - '0';
+		} else if (t->t_nums[t->t_curnum] < UINT_MAX / 100) {
+			/*
+			 * There is no need to continue parsing input
+			 * once the value exceeds the size of the
+			 * terminal. It would only allow for integer
+			 * overflows when performing arithmetic on the
+			 * cursor position.
+			 *
+			 * Ignore any further digits if the value is
+			 * already UINT_MAX / 100.
+			 */
+			t->t_nums[t->t_curnum] =
+			    t->t_nums[t->t_curnum] * 10 + c - '0';
 		}
-
-		t->t_nums[t->t_curnum] += c - '0';
 		return (1);
 	} else if (c == ';') {
 		if (t->t_stateflags & TS_FIRSTDIGIT)
diff --git a/sys/teken/teken_subr.h b/sys/teken/teken_subr.h
index 2eee627..d458f2a 100644
--- a/sys/teken/teken_subr.h
+++ b/sys/teken/teken_subr.h
@@ -324,13 +324,13 @@ static void
 teken_subr_cursor_position(teken_t *t, unsigned int row, unsigned int col)
 {
 
-	t->t_cursor.tp_row = t->t_originreg.ts_begin + row - 1;
-	if (t->t_cursor.tp_row >= t->t_originreg.ts_end)
-		t->t_cursor.tp_row = t->t_originreg.ts_end - 1;
+	row = row - 1 + t->t_originreg.ts_begin;
+	t->t_cursor.tp_row = row < t->t_originreg.ts_end ?
+	    row : t->t_originreg.ts_end - 1;
 
-	t->t_cursor.tp_col = col - 1;
-	if (t->t_cursor.tp_col >= t->t_winsize.tp_col)
-		t->t_cursor.tp_col = t->t_winsize.tp_col - 1;
+	col--;
+	t->t_cursor.tp_col = col < t->t_winsize.tp_col ?
+	    col : t->t_winsize.tp_col - 1;
 
 	t->t_stateflags &= ~TS_WRAPPED;
 	teken_funcs_cursor(t);
@@ -583,9 +583,9 @@ static void
 teken_subr_horizontal_position_absolute(teken_t *t, unsigned int col)
 {
 
-	t->t_cursor.tp_col = col - 1;
-	if (t->t_cursor.tp_col >= t->t_winsize.tp_col)
-		t->t_cursor.tp_col = t->t_winsize.tp_col - 1;
+	col--;
+	t->t_cursor.tp_col = col < t->t_winsize.tp_col ?
+	    col : t->t_winsize.tp_col - 1;
 
 	t->t_stateflags &= ~TS_WRAPPED;
 	teken_funcs_cursor(t);
@@ -1297,9 +1297,9 @@ static void
 teken_subr_vertical_position_absolute(teken_t *t, unsigned int row)
 {
 
-	t->t_cursor.tp_row = t->t_originreg.ts_begin + row - 1;
-	if (t->t_cursor.tp_row >= t->t_originreg.ts_end)
-		t->t_cursor.tp_row = t->t_originreg.ts_end - 1;
+	row = row - 1 + t->t_originreg.ts_begin;
+	t->t_cursor.tp_row = row < t->t_originreg.ts_end ?
+	    row : t->t_originreg.ts_end - 1;
 
 	t->t_stateflags &= ~TS_WRAPPED;
 	teken_funcs_cursor(t);