Merge branch 'busybox' into merge

1 files changed, 14 insertions, 2 deletions

diff --git a/libbb/lineedit.c b/libbb/lineedit.c
index c0edb7399..3df67abb1 100644
--- a/libbb/lineedit.c
+++ b/libbb/lineedit.c
@@ -687,6 +687,18 @@ static void free_tab_completion_data(void)
 
 static void add_match(char *matched)
 {
+        unsigned char *p = (unsigned char*)matched;
+        while (*p) {
+                /* ESC attack fix: drop any string with control chars */
+                if (*p < ' '
+                 || (!ENABLE_UNICODE_SUPPORT && *p >= 0x7f)
+                 || (ENABLE_UNICODE_SUPPORT && *p == 0x7f)
+                ) {
+                        free(matched);
+                        return;
+                }
+                p++;
+        }
         matches = xrealloc_vector(matches, 4, num_matches);
         matches[num_matches] = matched;
         num_matches++;
@@ -2457,6 +2469,8 @@ int FAST_FUNC read_line_input(line_input_t *st, const char *prompt, char *comman
         bb_error_msg("cur_history:%d cnt_history:%d", state->cur_history, state->cnt_history);
 #endif
 
+        /* Get width (before printing prompt) */
+        cmdedit_termw = get_terminal_width(STDIN_FILENO);
         /* Print out the command prompt, optionally ask where cursor is */
         parse_and_put_prompt(prompt);
         ask_terminal();
@@ -2466,8 +2480,6 @@ int FAST_FUNC read_line_input(line_input_t *st, const char *prompt, char *comman
         S.SIGWINCH_handler.sa_flags = SA_RESTART;
         sigaction(SIGWINCH, &S.SIGWINCH_handler, &S.SIGWINCH_handler);
 
-        cmdedit_termw = get_terminal_width(STDIN_FILENO);
-
         read_key_buffer[0] = 0;
         while (1) {
                 /*