git: 31f6cfca851f - releng/14.0 - tty: properly check character position when handling IUTF8 backspaces

The branch releng/14.0 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=31f6cfca851f20099162352dac8d044857b2e1f9

commit 31f6cfca851f20099162352dac8d044857b2e1f9
Author:     Bojan Novković <bojan.novkovic@fer.hr>
AuthorDate: 2023-11-13 18:02:30 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2023-12-04 14:06:29 +0000

    tty: properly check character position when handling IUTF8 backspaces
    
    The tty_rubchar() code handling backspaces for UTF-8 characters didn't
    properly check whether the beginning of the current line was reached.
    This resulted in a kernel panic in ttyinq_unputchar() when prodded with
    certain malformed UTF-8 sequences.
    
    PR:             275009
    Reviewed by:    christos
    Differential Revision:  https://reviews.freebsd.org/D42564
    Approved by:    so
    Security:       FreeBSD-EN-23:21.tty
    
    (cherry picked from commit c6d7be214811c315d234d64c6cbaa92d4f55d2c1)
    (cherry picked from commit ae8387cc818a0d6a2229ee049b671482e1549519)
---
 sys/kern/tty_ttydisc.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sys/kern/tty_ttydisc.c b/sys/kern/tty_ttydisc.c
index c46579cefbb1..cb5bf672d040 100644
--- a/sys/kern/tty_ttydisc.c
+++ b/sys/kern/tty_ttydisc.c
@@ -822,7 +822,13 @@ ttydisc_rubchar(struct tty *tp)
 				/* Loop back through inq until we hit the
 				 * leading byte. */
 				while (CTL_UTF8_CONT(c) && nb < UTF8_STACKBUF) {
-					ttyinq_peekchar(&tp->t_inq, &c, &quote);
+					/*
+					 * Check if we've reached the beginning
+					 * of the line.
+					 */
+					if (ttyinq_peekchar(&tp->t_inq, &c,
+					    &quote) != 0)
+						break;
 					ttyinq_unputchar(&tp->t_inq);
 					bytes[curidx] = c;
 					curidx--;