oss-sec mailing list archives

Re: terminal emulators' processing of escape sequences


From: Yves-Alexis Perez <corsac () debian org>
Date: Mon, 01 May 2017 19:25:00 +0200

On Mon, 2017-05-01 at 18:44 +0200, Solar Designer wrote:
Yves-Alexis Perez of Debian pointed out that whether these crashes occur
or not may be related to the version of vte.  I'll leave it up to him to
post a follow-up on that.

Indeed, original tests by Solar Designer and Jason A. Donenfeld might have
targeted xfce4-terminal 0.6 which is written in GTK2 and use vte2 while more
recent versions (starting 0.8) use GTK3 and vte3.

I tried running the perl script with current Debian sid and:

xfce4-terminal 0.8.4-1
libvte-2.91-0:amd64 0.46.1-1
libgtk-3-0:amd64 3.22.12-1

I wasn't able to make the process crash (it seems stuck at some point but the
window is somehow resized and I don't have access to the content so it' not
clear why).

Out of curiosity I also tried lxterminal (0.3.0-1) which is vte2 based, along
with:

libvte9 1:0.28.2-5+b
libgtk2.0-0:amd64 2.24.31-2

and I wasn't able to crash the process either. This time the perl process
terminates successfully.

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part


Current thread: