From fa31514de7c3d7c92d5256b5b53fc4c2ff17c862 Mon Sep 17 00:00:00 2001
From: Keith Winstein <keithw@mit.edu>
Date: Tue, 1 Feb 2011 05:19:04 -0500
Subject: [PATCH] Fix some crashers, including libc Unicode related

---
 parser.cpp              |  4 ++++
 termemu.cpp             |  2 --
 terminal.cpp            |  7 +++----
 terminalframebuffer.cpp | 35 +++++++++++++++++++++++++++++++----
 4 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/parser.cpp b/parser.cpp
index f2e62f0..994ca18 100644
--- a/parser.cpp
+++ b/parser.cpp
@@ -108,6 +108,10 @@ std::vector<Parser::Action *> Parser::UTF8Parser::input( char c )
       throw std::string( "Unknown return value from mbrtowc" );
     }
 
+    if ( (pwc < 0) || (pwc > 0x10FFFF) ) { /* outside Unicode range */
+      pwc = (wchar_t) 0xFFFD;
+    }
+
     std::vector<Action *> vec = parser.input( pwc );
     for ( std::vector<Action *>::iterator i = vec.begin();
 	  i != vec.end();
diff --git a/termemu.cpp b/termemu.cpp
index 79b7c06..e325fa3 100644
--- a/termemu.cpp
+++ b/termemu.cpp
@@ -184,6 +184,4 @@ int termemu( int fd, Terminal::Emulator *terminal, int debug_fd )
 
   /* write writeback */
   return swrite( fd, terminal_to_host.c_str(), terminal_to_host.length() );
-
-  return 0;
 }
diff --git a/terminal.cpp b/terminal.cpp
index aacd7d0..3be9ec8 100644
--- a/terminal.cpp
+++ b/terminal.cpp
@@ -82,9 +82,8 @@ void Emulator::print( Parser::Print *act )
     fb.apply_renditions_to_current_cell();
 
     if ( chwidth == 2 ) { /* erase overlapped cell */
-      Cell *next = fb.get_cell( fb.ds.get_cursor_row(), fb.ds.get_cursor_col() + 1 );
-      if ( next ) {
-	next->reset();
+      if ( fb.ds.get_cursor_col() + 1 < fb.ds.get_width() ) {
+	fb.get_cell( fb.ds.get_cursor_row(), fb.ds.get_cursor_col() + 1 )->reset();
       }
     }
 
@@ -156,7 +155,7 @@ void Emulator::debug_printout( int fd )
     snprintf( utf8, 8, "%lc", *i );
     screen.append( utf8 );
   }
-  screen.append( "\x7" ); /* xterm's "OSC" string ends in BEL... */
+  screen.append( "\033\\" );
 
   for ( int y = 0; y < fb.ds.get_height(); y++ ) {
     for ( int x = 0; x < fb.ds.get_width(); /* let charwidth handle advance */ ) {
diff --git a/terminalframebuffer.cpp b/terminalframebuffer.cpp
index 828162f..4ea7a88 100644
--- a/terminalframebuffer.cpp
+++ b/terminalframebuffer.cpp
@@ -69,8 +69,8 @@ void Framebuffer::scroll( int N )
     N = -N;
 
     for ( int i = 0; i < N; i++ ) {
-      rows.erase( rows.begin() + ds.get_scrolling_region_bottom_row() );
       rows.insert( rows.begin() + ds.get_scrolling_region_top_row(), Row( ds.get_width() ) );
+      rows.erase( rows.begin() + ds.get_scrolling_region_bottom_row() + 1 );
       ds.move_row( 1, true );
     }
   }
@@ -149,6 +149,15 @@ Cell *Framebuffer::get_cell( void )
   assert( ds.get_width() );
   assert( ds.get_height() );
 
+  assert( ds.get_cursor_row() < ds.get_height() );
+  assert( ds.get_cursor_col() < ds.get_width() );
+
+  assert( ds.get_cursor_row() >= 0 );
+  assert( ds.get_cursor_col() >= 0 );
+
+  assert( rows.size() == (size_t)ds.get_height() );
+  assert( rows[ ds.get_cursor_row() ].cells.size() == (size_t)ds.get_width() );
+
   return &rows[ ds.get_cursor_row() ].cells[ ds.get_cursor_col() ];
 }
 
@@ -157,6 +166,18 @@ Cell *Framebuffer::get_cell( int row, int col )
   if ( row == -1 ) row = ds.get_cursor_row();
   if ( col == -1 ) col = ds.get_cursor_col();
 
+  assert( ds.get_width() );
+  assert( ds.get_height() );
+
+  assert( row < ds.get_height() );
+  assert( col < ds.get_width() );
+
+  assert( row >= 0 );
+  assert( col >= 0 );
+
+  assert( rows.size() == (size_t)ds.get_height() );
+  assert( rows[ row ].cells.size() == (size_t)ds.get_width() );
+
   return &rows[ row ].cells[ col ];
 }
 
@@ -281,20 +302,26 @@ void Framebuffer::delete_line( int row )
     return;
   }
 
+  int insertbefore = ds.get_scrolling_region_bottom_row() + 1;
+  if ( insertbefore == ds.get_height() ) {
+    rows.push_back( Row( ds.get_width() ) );
+  } else {
+    rows.insert( rows.begin() + insertbefore, Row( ds.get_width() ) );
+  }
+
   rows.erase( rows.begin() + row );
-  rows.insert( rows.begin() + ds.get_scrolling_region_bottom_row(), Row( ds.get_width() ) );
 }
 
 void Row::insert_cell( int col )
 {
   cells.insert( cells.begin() + col, Cell() );
-  cells.erase( cells.end() - 1 );
+  cells.pop_back();
 }
 
 void Row::delete_cell( int col )
 {
-  cells.erase( cells.begin() + col );
   cells.push_back( Cell() );
+  cells.erase( cells.begin() + col );
 }
 
 void Framebuffer::insert_cell( int row, int col )