Do not write after the end of the array and overwrite the stack when

colon-separated SGR sequences contain empty arguments. Reported by Sergey
Nizovtsev.

1 files changed, 6 insertions, 1 deletions

diff --git a/input.c b/input.c
index e794be2a..c2e87611 100644
--- a/input.c
+++ b/input.c
@@ -1929,8 +1929,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
 				free(copy);
 				return;
 			}
-		} else
+		} else {
 			n++;
+			if (n == nitems(p)) {
+				free(copy);
+				return;
+			}
+		}
 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
 	}
 	free(copy);