Conversation
The select-by-typing fallback in ScreensPanel_eventHandlerNormal(),
ScreenTabsPanel_eventHandler() and ScreenNamesPanel_eventHandlerNormal()
guards only the upper bound:
if (ch < 255 && isalpha(ch))
but the value reaching a panel event handler is not always a character.
Panel.h defines EVENT_SET_SELECTED (-1), EVENT_PANEL_LOST_FOCUS (-2),
EVENT_HEADER_CLICK(x) (-10000 + x) and EVENT_SCREEN_TAB_CLICK(x)
(-20000 + x), and ScreenManager_run() dispatches all of them to the
focused panel; ERR (-1) can arrive as well. Only some of those are
matched by an explicit case, the rest fall through to the default
branch.
C11 7.4p1 requires the argument of the <ctype.h> functions to be
representable as an unsigned char or equal EOF, so this indexes glibc's
ctype table far out of bounds. It is not merely theoretical - a
standalone reproduction of the same expression:
ch=-2 table index -2 isalpha()=0
ch=-10000 table index -10000 isalpha()=0
ch=-19997 table index -19997 isalpha()=1
the last one making htop call Panel_selectByTyping() with -19997.
Use the same guard the other panels already use:
if (0 < ch && ch < 255 && isalpha((unsigned char)ch))
Assisted-by: Claude Opus 5
Signed-off-by: hanjinpeng <hanjinpeng@kylinos.cn>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review. 📝 WalkthroughWalkthroughThe tab and screen name handlers now call
Priority: ⬇️ Low Change: Bug fix Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Letters pass through the panel gate Comment |
The select-by-typing fallback in ScreensPanel_eventHandlerNormal(), ScreenTabsPanel_eventHandler() and ScreenNamesPanel_eventHandlerNormal() guards only the upper bound:
but the value reaching a panel event handler is not always a character. Panel.h defines EVENT_SET_SELECTED (-1), EVENT_PANEL_LOST_FOCUS (-2), EVENT_HEADER_CLICK(x) (-10000 + x) and EVENT_SCREEN_TAB_CLICK(x) (-20000 + x), and ScreenManager_run() dispatches all of them to the focused panel; ERR (-1) can arrive as well. Only some of those are matched by an explicit case, the rest fall through to the default branch.
C11 7.4p1 requires the argument of the <ctype.h> functions to be representable as an unsigned char or equal EOF, so this indexes glibc's ctype table far out of bounds. It is not merely theoretical - a standalone reproduction of the same expression:
the last one making htop call Panel_selectByTyping() with -19997.
Use the same guard the other panels already use: