54147: avoid buffer overflow with terminal sequences

2 files changed, 7 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index b4adc0235..8f6b9adbb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2025-12-16  Oliver Kiddle  <opk@zsh.org>
+
+	* 54147: Src/Zle/termquery.c: avoid buffer overflow with
+	terminal sequences
+
 2025-11-30  Oliver Kiddle  <opk@zsh.org>
 
 	* Christopher Bock: 54117: update apt completion
diff --git a/Src/Zle/termquery.c b/Src/Zle/termquery.c
index a2d617db8..c8f5385d9 100644
--- a/Src/Zle/termquery.c
+++ b/Src/Zle/termquery.c
@@ -703,10 +703,10 @@ collate_seq(int sindex, int dir)
 	}
         if (enabled) {
 	    if (i)
-		strucpy(&pos, editext[i].seq[sindex]);
+		struncpy(&pos, editext[i].seq[sindex], seq + sizeof(seq) - pos - 1);
 	    else if ((bracket = getaparam("zle_bracketed_paste")) &&
 		    arrlen(bracket) == 2)
-		strucpy(&pos, bracket[sindex]);
+		struncpy(&pos, bracket[sindex], seq + sizeof(seq) - pos - 1);
 	}
     }
     write_loop(SHTTY, seq, pos - seq);