aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-27 04:14:06 -04:00
Code Activity

patch 8.1.0048: vim_str2nr() does not handle numbers close to the maximum

Browse Source 
Problem:    vim_str2nr() does not handle numbers close to the maximum.
Solution:   Check for overflow more precisely. (Ken Takata, closes #2746)
This commit is contained in:
Bram Moolenaar
2018-06-12 17:25:36 +02:00
parent 1983401088
commit 07ccf7ce7f
2 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/charset.c
View File

@@ -1928,8 +1928,8 @@ vim_str2nr(
while ('0' <= *ptr && *ptr <= '1') while ('0' <= *ptr && *ptr <= '1')
{ {
/* avoid ubsan error for overflow */ /* avoid ubsan error for overflow */
if (un < UVARNUM_MAX / 2) if (un <= UVARNUM_MAX / 2)
un = 2 * un + (unsigned long)(*ptr - '0'); un = 2 * un + (uvarnumber_T)(*ptr - '0');
else else
un = UVARNUM_MAX; un = UVARNUM_MAX;
++ptr; ++ptr;
@@ -1943,7 +1943,7 @@ vim_str2nr(
while ('0' <= *ptr && *ptr <= '7') while ('0' <= *ptr && *ptr <= '7')
{ {
/* avoid ubsan error for overflow */ /* avoid ubsan error for overflow */
if (un < UVARNUM_MAX / 8) if (un <= UVARNUM_MAX / 8)
un = 8 * un + (uvarnumber_T)(*ptr - '0'); un = 8 * un + (uvarnumber_T)(*ptr - '0');
else else
un = UVARNUM_MAX; un = UVARNUM_MAX;
@@ -1960,7 +1960,7 @@ vim_str2nr(
while (vim_isxdigit(*ptr)) while (vim_isxdigit(*ptr))
{ {
/* avoid ubsan error for overflow */ /* avoid ubsan error for overflow */
if (un < UVARNUM_MAX / 16) if (un <= UVARNUM_MAX / 16)
un = 16 * un + (uvarnumber_T)hex2nr(*ptr); un = 16 * un + (uvarnumber_T)hex2nr(*ptr);
else else
un = UVARNUM_MAX; un = UVARNUM_MAX;
@@ -1974,9 +1974,12 @@ vim_str2nr(
/* decimal */ /* decimal */
while (VIM_ISDIGIT(*ptr)) while (VIM_ISDIGIT(*ptr))
{ {
uvarnumber_T digit = (uvarnumber_T)(*ptr - '0');
/* avoid ubsan error for overflow */ /* avoid ubsan error for overflow */
if (un < UVARNUM_MAX / 10) if (un < UVARNUM_MAX / 10
un = 10 * un + (uvarnumber_T)(*ptr - '0'); || (un == UVARNUM_MAX / 10 && digit <= UVARNUM_MAX % 10))
un = 10 * un + digit;
else else
un = UVARNUM_MAX; un = UVARNUM_MAX;
++ptr; ++ptr;

2
src/version.c
View File

@@ -761,6 +761,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
48,
/**/ /**/
47, 47,
/**/ /**/