aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-24 03:44:06 -04:00
Code Activity

patch 8.2.0513: reading past allocate memory when using varargs

Browse Source 
Problem:    Reading past allocate memory when using varargs.
Solution:   Fix copying function argument types.
This commit is contained in:
Bram Moolenaar
2020-04-05 18:20:45 +02:00
parent 5deeb3f1f9
commit 5d905c2b96
2 changed files with 16 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/version.c
View File

@@ -738,6 +738,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
513,
/**/ /**/
512, 512,
/**/ /**/

21
src/vim9compile.c
View File

@@ -353,7 +353,8 @@ get_func_type(type_T *ret_type, int argcount, garray_T *type_gap)
} }
/* /*
* For a function type, reserve space for "argcount" argument types. * For a function type, reserve space for "argcount" argument types (including
* vararg).
*/ */
static int static int
func_type_add_arg_types( func_type_add_arg_types(
@@ -5823,16 +5824,19 @@ compile_def_function(ufunc_T *ufunc, int set_return_type)
} }
{ {
int argcount = ufunc->uf_args.ga_len int varargs = ufunc->uf_va_name != NULL;
+ (ufunc->uf_va_name == NULL ? 0 : 1); int argcount = ufunc->uf_args.ga_len - (varargs ? 1 : 0);
// Create a type for the function, with the return type and any // Create a type for the function, with the return type and any
// argument types. // argument types.
ufunc->uf_func_type = get_func_type(ufunc->uf_ret_type, argcount, // A vararg is included in uf_args.ga_len but not in uf_arg_types.
&ufunc->uf_type_list); // The type is included in "tt_args".
if (argcount > 0) ufunc->uf_func_type = get_func_type(ufunc->uf_ret_type,
ufunc->uf_args.ga_len, &ufunc->uf_type_list);
if (ufunc->uf_args.ga_len > 0)
{ {
if (func_type_add_arg_types(ufunc->uf_func_type, argcount, if (func_type_add_arg_types(ufunc->uf_func_type,
ufunc->uf_args.ga_len,
argcount - ufunc->uf_def_args.ga_len, argcount - ufunc->uf_def_args.ga_len,
&ufunc->uf_type_list) == FAIL) &ufunc->uf_type_list) == FAIL)
{ {
@@ -5850,6 +5854,9 @@ compile_def_function(ufunc_T *ufunc, int set_return_type)
else else
mch_memmove(ufunc->uf_func_type->tt_args, mch_memmove(ufunc->uf_func_type->tt_args,
ufunc->uf_arg_types, sizeof(type_T *) * argcount); ufunc->uf_arg_types, sizeof(type_T *) * argcount);
if (varargs)
ufunc->uf_func_type->tt_args[argcount] =
ufunc->uf_va_type == NULL ? &t_any : ufunc->uf_va_type;
} }
} }