From 270f2e0561f538a7f059895ea3555c6f4512a118 Mon Sep 17 00:00:00 2001 From: Florian Mayer Date: Fri, 31 Jan 2025 16:12:03 -0800 Subject: [PATCH] Account for WIN_MESSAGE == WIN_ERR in free_window_info In fact, it is always WIN_ERR in the caller in line 1403 This tripped UBSan's bounds checks --- win/tty/wintty.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/win/tty/wintty.c b/win/tty/wintty.c index e8c39743b..5e9c547b9 100644 --- a/win/tty/wintty.c +++ b/win/tty/wintty.c @@ -1559,7 +1559,8 @@ boolean free_data; int i; if (cw->data) { - if (cw == wins[WIN_MESSAGE] && cw->rows > cw->maxrow) + if (WIN_MESSAGE != WIN_ERR && cw == wins[WIN_MESSAGE] + && cw->rows > cw->maxrow) cw->maxrow = cw->rows; /* topl data */ for (i = 0; i < cw->maxrow; i++) if (cw->data[i]) {