gyscos / gyscos/cursive

crash on showing specially crafted string

Open
#489 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
4.8k
Forks
270
Avg merge
5d 19h
Merged PRs (30d)
2

Description

First: is this a bug report? A suggestion? Or asking for help?

bug report

# Problem description

My fuzzing found an panic inside cursive itself when displaying a string supplied from an untrusted source:

```
thread '' panicked at 'byte index 1 is not a char boundary; it is inside '\u{85}' (bytes 0..2) of `
-`', /home/capitol/projects/cursive/cursive-core/src/utils/lines/spans/segment.rs:24:24
```

Can be replicated with with program:

```
use cursive::views::{Dialog, TextView};
use std::str;

fn main() {
let d: Vec = vec![194, 133, 45, 127, 29, 127, 127];
let str = str::from_utf8(&d);
if let Ok(s) = str {
// Creates the cursive root - required for every application.
let mut siv = cursive::default();

// Creates a dialog with a single "Quit" button
siv.add_layer(Dialog::around(TextView::new(s))
.title("Cursive")
.button("Quit", |s| s.quit()));

siv.run();
} else {
println!("not valid utf8");
}
}
```

# Environment

* Operating system: linux (ubuntu 20.04)
* Backend used: ncurses (the default one) but looks like it applies to all of them
* Current locale (run `locale` in a terminal).
```
$ locale
LANG=en_US.UTF-8
LANGUAGE=
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC=nb_NO.UTF-8
LC_TIME=nb_NO.UTF-8
LC_COLLATE="en_US.UTF-8"
LC_MONETARY=nb_NO.UTF-8
LC_MESSAGES="en_US.UTF-8"
LC_PAPER=nb_NO.UTF-8
LC_NAME=nb_NO.UTF-8
LC_ADDRESS=nb_NO.UTF-8
LC_TELEPHONE=nb_NO.UTF-8
LC_MEASUREMENT=nb_NO.UTF-8
LC_IDENTIFICATION=nb_NO.UTF-8
LC_ALL=
```
* Cursive version (from crates.io, from git, ...): replicated in git an 0.15

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.