git: 31f6cfca851f - releng/14.0 - tty: properly check character position when handling IUTF8 backspaces

[Mark Johnston]

The branch releng/14.0 has been updated by markj:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=31f6cfca851f20099162352dac8d044857b2e1f9

commit 31f6cfca851f20099162352dac8d044857b2e1f9
Author:     Bojan Novković <bojan.novko...@fer.hr>
AuthorDate: 2023-11-13 18:02:30 +0000
Commit:     Mark Johnston <ma...@freebsd.org>
CommitDate: 2023-12-04 14:06:29 +0000

    tty: properly check character position when handling IUTF8 backspaces
    
    The tty_rubchar() code handling backspaces for UTF-8 characters didn't
    properly check whether the beginning of the current line was reached.
    This resulted in a kernel panic in ttyinq_unputchar() when prodded with
    certain malformed UTF-8 sequences.
    
    PR:             275009
    Reviewed by:    christos
    Differential Revision:  https://reviews.freebsd.org/D42564
    Approved by:    so
    Security:       FreeBSD-EN-23:21.tty
    
    (cherry picked from commit c6d7be214811c315d234d64c6cbaa92d4f55d2c1)
    (cherry picked from commit ae8387cc818a0d6a2229ee049b671482e1549519)
---
 sys/kern/tty_ttydisc.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sys/kern/tty_ttydisc.c b/sys/kern/tty_ttydisc.c
index c46579cefbb1..cb5bf672d040 100644
--- a/sys/kern/tty_ttydisc.c
+++ b/sys/kern/tty_ttydisc.c
@@ -822,7 +822,13 @@ ttydisc_rubchar(struct tty *tp)
                                /* Loop back through inq until we hit the
                                 * leading byte. */
                                while (CTL_UTF8_CONT(c) && nb < UTF8_STACKBUF) {
-                                       ttyinq_peekchar(&tp->t_inq, &c, &quote);
+                                       /*
+                                        * Check if we've reached the beginning
+                                        * of the line.
+                                        */
+                                       if (ttyinq_peekchar(&tp->t_inq, &c,
+                                           &quote) != 0)
+                                               break;
                                        ttyinq_unputchar(&tp->t_inq);
                                        bytes[curidx] = c;
                                        curidx--;