From daf7d4468425e3e42e6158ef44a129d31b4c73b3 Mon Sep 17 00:00:00 2001
From: Keith Winstein <keithw@mit.edu>
Date: Thu, 13 Oct 2011 03:39:16 -0400
Subject: [PATCH] Include bounds check in CursorMove validity

---
 terminaloverlay.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/terminaloverlay.cpp b/terminaloverlay.cpp
index 358ef9e..44a2a7f 100644
--- a/terminaloverlay.cpp
+++ b/terminaloverlay.cpp
@@ -55,6 +55,11 @@ void CursorMove::apply( Framebuffer &fb ) const
 
 Validity ConditionalCursorMove::get_validity( const Framebuffer &fb ) const
 {
+  if ( (new_row >= fb.ds.get_height())
+       || (new_col >= fb.ds.get_width()) ) {
+    return IncorrectOrExpired;
+  }
+
   if ( timestamp() < expiration_time ) {
     return Pending;
   }