Do not try to put more in command message than will fit when sending

(the server will treat as a fatal error). GitHub issue 1200.

diff --git a/usr.bin/tmux/client.c b/usr.bin/tmux/client.c
index 17f10a5..152b9c8 100644 (file)
--- a/usr.bin/tmux/client.c
+++ b/usr.bin/tmux/client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: client.c,v 1.123 2017/07/14 18:49:07 nicm Exp $ */
+/* $OpenBSD: client.c,v 1.124 2017/12/18 22:13:36 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -337,6 +337,10 @@ client_main(struct event_base *base, int argc, char **argv, int flags)
                size = 0;
                for (i = 0; i < argc; i++)
                        size += strlen(argv[i]) + 1;
+               if (size > MAX_IMSGSIZE - (sizeof *data)) {
+                       fprintf(stderr, "command too long\n");
+                       return (1);
+               }
                data = xmalloc((sizeof *data) + size);
 
                /* Prepare command for server. */