Fix bug #15575 with crashes in TTY menus.

 src/xdisp.c (display_tty_menu_item): Make sure we never write beyond
 the end of the frame's glyph matrix.
 src/term.c (tty_menu_display): Don't move cursor while overwriting
 frame's glyphs with menu items.  Limit the number of items
 displayed to what can be shown on the available screen lines,
 excluding the echo area.
 (tty_menu_activate): Limit the Y coordinate allowed by
 read_menu_input to the last screen line used for menu display.

1 files changed, 7 insertions, 3 deletions

diff --git a/src/term.c b/src/term.c
index a4f8f2ea17c..9437faee8a2 100644
--- a/src/term.c
+++ b/src/term.c
@@ -2919,17 +2919,20 @@ tty_menu_display (tty_menu *menu, int x, int y, int pn, int *faces,
   int i, face, width, enabled, mousehere, row, col;
   struct frame *sf = SELECTED_FRAME ();
   struct tty_display_info *tty = FRAME_TTY (sf);
+  /* Don't try to display more menu items than the console can display
+     using the available screen lines.  Exclude the echo area line, as
+     it will be overwritten by the help-echo anyway.  */
+  int max_items = min (menu->count, FRAME_LINES (sf) - 1);
 
   menu_help_message = NULL;
 
   width = menu->width;
   col = cursorX (tty);
   row = cursorY (tty);
-  for (i = 0; i < menu->count; i++)
+  for (i = 0; i < max_items; i++)
     {
       int max_width = width + 2; /* +2 for padding blanks on each side */
 
-      cursor_to (sf, y + i, x);
       if (menu->submenu[i])
         max_width += 2; /* for displaying " >" after the item */
       enabled
@@ -3285,7 +3288,8 @@ tty_menu_activate (tty_menu *menu, int *pane, int *selidx,
   while (!leave)
     {
       int input_status;
-      int min_y = state[0].y, max_y = min_y + state[0].menu->count - 1;
+      int min_y = state[0].y;
+      int max_y = min (min_y + state[0].menu->count, FRAME_LINES (sf)) - 1;
 
       input_status = read_menu_input (sf, &x, &y, min_y, max_y, &first_time);
       if (input_status)