C4Sh3R

An out-of-bounds write exists in the PEA archive extraction routine within the `unpea procedure` function of the `pea.pas` file. The issue occurs when decompressing a PCOMPRESS1 stream, where the 32-bit compressed-block-size field of the first block (`compsize`) is read from the archive and used without validation as the length for a block read into the fixed-size global buffers `wbuf1` and `wbuf2` (1,114,112 bytes). This allows the first block to bypass the `compsize > WBUFSIZE` check, leading to an out-of-bounds read at an attacker-chosen offset via `wbuf1[compsize]`. Additionally, the copy loop uses the requested length instead of the actual bytes read and terminates on equality rather than an upper bound. This memory corruption can be triggered by opening or extracting a crafted .pea archive, potentially allowing arbitrary code execution as the user running the application across Windows, macOS, Linux, and BSD platforms.

An out-of-bounds write exists in the natural width branch of the text sizing protocol. The `screen handle multicell command()` function in `kitty/screen.c` appends each codepoint of a grapheme cluster using `lc.chars[lc.count++] = ch` without performing a capacity check. Because `lc` is declared as a four-element `char type` array via the `RAII ListOfChars` macro, an OSC 66 escape code containing a grapheme cluster longer than four codepoints writes beyond the buffer. If the cluster is preceded by a sequence causing an intermediate flush, the buffer is migrated to the heap by `ensure space for chars()`, and the write occurs past the heap allocation. This leads to the termination of the kitty process, including all associated windows, tabs, and child processes.

An authorization flaw exists in the drag and drop protocol handling. A program writing to the terminal can obtain the contents of files dragged over the window even if the user does not complete the drop action. This occurs because the `drop enqueue request()` function in `kitty/dnd.c` serves drag data requests without verifying the drop state of the window, allowing a client to receive data while a drag is merely hovering. Additionally, the `drop left child()` function fails to clear the pending request state, open file descriptors, directory handles, and URI lists when a drag leaves the window. Consequently, a client can continue reading through a retained directory handle or maintain an active file transfer stream after the drag has ended. The kitty process reads the file contents directly from the filesystem using paths provided by the drag source, leading to unauthorized disclosure of file contents.