aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-26 04:04:07 -04:00
Code Activity

patch 9.0.1740: segfault when reading invalid viminfo file

Browse Source 
Problem: segfault when reading invalid viminfo file
Solution: Check the expected type in the viminfo file

Thanks to @yegappan for the included test.

closes: #12652
closes: #12845

Signed-off-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Pierre Colin <48397990+Pierre-Colin@users.noreply.github.com>
Co-authored-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Co-authored-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Pierre Colin
2023-08-19 11:56:57 +02:00
committed by Christian Brabandt
parent 38ab19e00f
commit 0a07646845
3 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/testdir/test_viminfo.vim
View File

@@ -614,6 +614,26 @@ func Test_viminfo_bad_syntax2()
rviminfo Xviminfo rviminfo Xviminfo
endfunc endfunc
" This used to crash Vim (GitHub issue #12652)
func Test_viminfo_bad_syntax3()
let lines =<< trim END
call writefile([], 'Xvbs3.result')
qall!
END
call writefile(lines, 'Xvbs3script', 'D')
let lines = []
call add(lines, '|1,4')
" bad viminfo syntax for register barline
call add(lines, '|3,1,1,1,1,0,71489,,125') " empty line1
call writefile(lines, 'Xviminfo', 'D')
call RunVim([], [], '--clean -i Xviminfo -S Xvbs3script')
call assert_true(filereadable('Xvbs3.result'))
call delete('Xvbs3.result')
endfunc
func Test_viminfo_file_marks() func Test_viminfo_file_marks()
silent! bwipe test_viminfo.vim silent! bwipe test_viminfo.vim
silent! bwipe Xviminfo silent! bwipe Xviminfo

2
src/version.c
View File

@@ -695,6 +695,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
1740,
/**/ /**/
1739, 1739,
/**/ /**/

5
src/viminfo.c
View File

@@ -1804,6 +1804,11 @@ handle_viminfo_register(garray_T *values, int force)
y_ptr->y_array[i] = vp[i + 6].bv_string; y_ptr->y_array[i] = vp[i + 6].bv_string;
vp[i + 6].bv_string = NULL; vp[i + 6].bv_string = NULL;
} }
else if (vp[i + 6].bv_type != BVAL_STRING)
{
free(y_ptr->y_array);
y_ptr->y_array = NULL;
}
else else
y_ptr->y_array[i] = vim_strsave(vp[i + 6].bv_string); y_ptr->y_array[i] = vim_strsave(vp[i + 6].bv_string);
} }