Ghostty lib-vt got integer overflows panic during resize

[c0x0o]

Issue Description

The crashed stacktrace looks like:

Thread 10 Crashed::  Dispatch queue: com.*********.ling.render.b31e81000
0   libsystem_kernel.dylib        	       0x184d5e5e8 __pthread_kill + 8
1   libsystem_pthread.dylib       	       0x184d998d8 pthread_kill + 296
2   libsystem_c.dylib             	       0x184ca0644 abort + 148
3   libghostty-vt.dylib           	       0x104447c54 posix.abort + 12
4   libghostty-vt.dylib           	       0x104419474 debug.defaultPanic + 444
5   libghostty-vt.dylib           	       0x1043f3658 debug.FullPanic((function 'defaultPanic')).integerOverflow + 48
6   libghostty-vt.dylib           	       0x104422278 terminal.PageList.resizeCols + 576
7   libghostty-vt.dylib           	       0x104401894 terminal.PageList.resize + 400
8   libghostty-vt.dylib           	       0x1043fde3c terminal.Terminal.resize + 1212
9   libghostty-vt.dylib           	       0x104403274 ghostty_terminal_resize + 120
10  libling.dylib                 	       0x1046cb63c ghostty.Emulator.resize + 16 (ghostty.zig:537) [inlined]
11  libling.dylib                 	       0x1046cb63c session.Session.resize + 88 (session.zig:302) [inlined]
12  libling.dylib                 	       0x1046cb63c darwin.terminal_surface.TerminalSurface.commitLayoutForViewport + 88 (terminal_surface.zig:1278) [inlined]
13  libling.dylib                 	       0x1046cb63c darwin.terminal_surface.TerminalSurface.renderFrameInner + 88 (terminal_surface.zig:1142) [inlined]
14  libling.dylib                 	       0x1046cb63c darwin.terminal_surface.TerminalSurface.renderFrame + 1404 (terminal_surface.zig:1095)
15  libdispatch.dylib             	       0x184bf84b0 _dispatch_client_callout + 16
16  libdispatch.dylib             	       0x184be7030 _dispatch_lane_serial_drain + 740
17  libdispatch.dylib             	       0x184be7b2c _dispatch_lane_invoke + 392
18  libdispatch.dylib             	       0x184bf1e34 _dispatch_root_queue_drain_deferred_wlh + 284
19  libdispatch.dylib             	       0x184bf1734 _dispatch_workloop_worker_thread + 720
20  libsystem_pthread.dylib       	       0x184d95ec0 _pthread_wqthread + 292
21  libsystem_pthread.dylib       	       0x184d94c10 start_wqthread + 8

integer-overflow panic in PageList.resizeCols when a single
ghostty_terminal_resize() call shrinks BOTH cols and rows while the
pre-resize cursor row is >= the new rows.

PageList.resize takes the .lt branch (new cols < old cols): it first
runs resizeWithoutReflow, which mutates self.rows down to the new value,
hen calls resizeCols(cols, opts.cursor). opts.cursor.y is the original
cursor row from before the resize, so the expression at the top of
resizeCols:

.remaining_rows = self.rows - c.y - 1,

underflows when c.y >= new self.rows. The same pattern appears later in
the function (self.rows - active_pt.active.y - 1).

Expected Behavior

Should not crash when user shrinks the terminal on vertical and horizontal direction simultaneously.

Actual Behavior

It crashed

Reproduction Steps

Running this minimum PoC:

// Build (with libghostty-vt headers + dylib on the standard search paths):
//   zig run poc.zig -lghostty-vt
//
// Or point at a local build:
//   zig run poc.zig -I <prefix>/include -L <prefix>/lib -lghostty-vt
//
// At runtime the dylib must be discoverable (DYLD_LIBRARY_PATH on macOS,
// LD_LIBRARY_PATH on Linux, or an rpath baked in at link time).

const std = @import("std");
const c = @cImport({
    @cInclude("ghostty/vt.h");
});

pub fn main() !void {
    var term: c.GhosttyTerminal = null;
    const opts: c.GhosttyTerminalOptions = .{
        .cols = 80,
        .rows = 24,
        .max_scrollback = 0,
    };
    if (c.ghostty_terminal_new(null, &term, opts) != c.GHOSTTY_SUCCESS) {
        return error.InitFailed;
    }
    defer c.ghostty_terminal_free(term);

    // CSI 24;1H -> park the cursor on the bottom row (1-based).
    const move = "\x1b[24;1H";
    _ = c.ghostty_terminal_vt_write(term, move.ptr, move.len);

    // Shrink both axes by one cell. Panics with `integer overflow` in
    // _terminal.PageList.resizeCols.
    _ = c.ghostty_terminal_resize(term, 79, 23, 8, 16);
}

Ghostty Logs

No response

Ghostty Version

Tested the on main branch

OS Version Information

macOS 26.5

(Linux only) Display Server

None

(Linux only) Desktop Environment/Window Manager

No response

Minimal Ghostty Configuration

no related

Additional Relevant Configuration

No response

I acknowledge that:

• I have reviewed the FAQ and confirm that my issue is NOT among them.
• I have searched the Ghostty repository (both open and closed Discussions and Issues) and confirm this is not a duplicate of an existing issue or discussion.
• I have checked the "Preview" tab on all text fields to ensure that everything looks right, and have wrapped all configuration and code in code blocks with a group of three backticks (```) on separate lines.

[c0x0o]

I've already got a fix. I would like to open a PR at anytime.

[c0x0o]

PR created #12907

[jcollie]

!vouch