Blame SOURCES/xterm-CVE-2021-27135.patch

4cb70e
diff --git a/button.c b/button.c
4cb70e
index ac1f742..4e8554d 100644
4cb70e
--- a/button.c
4cb70e
+++ b/button.c
4cb70e
@@ -3802,6 +3802,7 @@ SaltTextAway(XtermWidget xw,
4cb70e
     TScreen *screen = TScreenOf(xw);
4cb70e
     int i, j = 0;
4cb70e
     int eol;
4cb70e
+	size_t have = 0;
4cb70e
     Char *line;
4cb70e
     Char *lp;
4cb70e
     CELL first = *cellc;
4cb70e
@@ -3827,7 +3828,11 @@ SaltTextAway(XtermWidget xw,
4cb70e
 
4cb70e
     /* UTF-8 may require more space */
4cb70e
     if_OPT_WIDE_CHARS(screen, {
4cb70e
-	j *= 4;
4cb70e
+	if (j > 0) {
4cb70e
+	    if (screen->max_combining > 0)
4cb70e
+		j += screen->max_combining;
4cb70e
+	    j *= 6;
4cb70e
+	}
4cb70e
     });
4cb70e
 
4cb70e
     /* now get some memory to save it in */
4cb70e
@@ -3864,10 +3869,27 @@ SaltTextAway(XtermWidget xw,
4cb70e
     }
4cb70e
     *lp = '\0';			/* make sure we have end marked */
4cb70e
 
4cb70e
-    TRACE(("Salted TEXT:%d:%s\n", (int) (lp - line),
4cb70e
-	   visibleChars(line, (unsigned) (lp - line))));
4cb70e
+    have = (size_t) (lp - line);
4cb70e
+    /*
4cb70e
+     * Scanning the buffer twice is unnecessary.  Discard unwanted memory if
4cb70e
+     * the estimate is too-far off.
4cb70e
+     */
4cb70e
+    if ((have * 2) < (size_t) j) {
4cb70e
+		Char *next;
4cb70e
+		screen->selection_size = have + 1;
4cb70e
+		next = realloc(line, screen->selection_size);
4cb70e
+		if (next == NULL) {
4cb70e
+			free(line);
4cb70e
+			screen->selection_length = 0;
4cb70e
+			screen->selection_size = 0;
4cb70e
+		}
4cb70e
+		screen->selection_data = next;
4cb70e
+    }
4cb70e
+
4cb70e
+	screen->selection_length = have;
4cb70e
 
4cb70e
-    screen->selection_length = (unsigned long) (lp - line);
4cb70e
+    TRACE(("Salted TEXT:%u:%s\n", (unsigned) have,
4cb70e
+	   visibleChars(screen->selection_data, (unsigned) have)));
4cb70e
 }
4cb70e
 
4cb70e
 #if OPT_PASTE64