aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-27 04:14:06 -04:00
Code Activity

patch 8.2.4245: ":retab 0" may cause illegal memory access

Browse Source 
Problem:    ":retab 0" may cause illegal memory access.
Solution:   Limit the value of 'tabstop' to 10000.
This commit is contained in:
Bram Moolenaar
2022-01-28 20:47:49 +00:00
parent 14cbf77845
commit 652dee4486
5 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/indent.c
View File

@@ -71,7 +71,7 @@ tabstop_set(char_u *var, int **array)
int n = atoi((char *)cp); int n = atoi((char *)cp);
// Catch negative values, overflow and ridiculous big values. // Catch negative values, overflow and ridiculous big values.
if (n < 0 || n > 9999) if (n < 0 || n > TABSTOP_MAX)
{ {
semsg(_(e_invalid_argument_str), cp); semsg(_(e_invalid_argument_str), cp);
vim_free(*array); vim_free(*array);
@@ -1649,7 +1649,7 @@ ex_retab(exarg_T *eap)
emsg(_(e_argument_must_be_positive)); emsg(_(e_argument_must_be_positive));
return; return;
} }
if (new_ts < 0 || new_ts > 9999) if (new_ts < 0 || new_ts > TABSTOP_MAX)
{ {
semsg(_(e_invalid_argument_str), eap->arg); semsg(_(e_invalid_argument_str), eap->arg);
return; return;

14
src/option.c
View File

@@ -3752,6 +3752,11 @@ set_num_option(
errmsg = e_argument_must_be_positive; errmsg = e_argument_must_be_positive;
curbuf->b_p_ts = 8; curbuf->b_p_ts = 8;
} }
else if (curbuf->b_p_ts > TABSTOP_MAX)
{
errmsg = e_invalid_argument;
curbuf->b_p_ts = 8;
}
if (p_tm < 0) if (p_tm < 0)
{ {
errmsg = e_argument_must_be_positive; errmsg = e_argument_must_be_positive;
@@ -5983,7 +5988,7 @@ buf_copy_options(buf_T *buf, int flags)
if (p_vsts && p_vsts != empty_option) if (p_vsts && p_vsts != empty_option)
(void)tabstop_set(p_vsts, &buf->b_p_vsts_array); (void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
else else
buf->b_p_vsts_array = 0; buf->b_p_vsts_array = NULL;
buf->b_p_vsts_nopaste = p_vsts_nopaste buf->b_p_vsts_nopaste = p_vsts_nopaste
? vim_strsave(p_vsts_nopaste) : NULL; ? vim_strsave(p_vsts_nopaste) : NULL;
#endif #endif
@@ -6803,9 +6808,7 @@ paste_option_changed(void)
if (buf->b_p_vsts) if (buf->b_p_vsts)
free_string_option(buf->b_p_vsts); free_string_option(buf->b_p_vsts);
buf->b_p_vsts = empty_option; buf->b_p_vsts = empty_option;
if (buf->b_p_vsts_array) VIM_CLEAR(buf->b_p_vsts_array);
vim_free(buf->b_p_vsts_array);
buf->b_p_vsts_array = 0;
#endif #endif
} }
@@ -6851,12 +6854,11 @@ paste_option_changed(void)
free_string_option(buf->b_p_vsts); free_string_option(buf->b_p_vsts);
buf->b_p_vsts = buf->b_p_vsts_nopaste buf->b_p_vsts = buf->b_p_vsts_nopaste
? vim_strsave(buf->b_p_vsts_nopaste) : empty_option; ? vim_strsave(buf->b_p_vsts_nopaste) : empty_option;
if (buf->b_p_vsts_array)
vim_free(buf->b_p_vsts_array); vim_free(buf->b_p_vsts_array);
if (buf->b_p_vsts && buf->b_p_vsts != empty_option) if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array); (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
else else
buf->b_p_vsts_array = 0; buf->b_p_vsts_array = NULL;
#endif #endif
} }

2
src/testdir/test_options.vim
View File

@@ -368,6 +368,8 @@ func Test_set_errors()
call assert_fails('set shiftwidth=-1', 'E487:') call assert_fails('set shiftwidth=-1', 'E487:')
call assert_fails('set sidescroll=-1', 'E487:') call assert_fails('set sidescroll=-1', 'E487:')
call assert_fails('set tabstop=-1', 'E487:') call assert_fails('set tabstop=-1', 'E487:')
call assert_fails('set tabstop=10000', 'E474:')
call assert_fails('set tabstop=5500000000', 'E474:')
call assert_fails('set textwidth=-1', 'E487:') call assert_fails('set textwidth=-1', 'E487:')
call assert_fails('set timeoutlen=-1', 'E487:') call assert_fails('set timeoutlen=-1', 'E487:')
call assert_fails('set updatecount=-1', 'E487:') call assert_fails('set updatecount=-1', 'E487:')

2
src/version.c
View File

@@ -750,6 +750,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
4245,
/**/ /**/
4244, 4244,
/**/ /**/

2
src/vim.h
View File

@@ -2085,6 +2085,8 @@ typedef int sock_T;
#define DICT_MAXNEST 100 // maximum nesting of lists and dicts #define DICT_MAXNEST 100 // maximum nesting of lists and dicts
#define TABSTOP_MAX 9999
#ifdef FEAT_CLIPBOARD #ifdef FEAT_CLIPBOARD
// VIM_ATOM_NAME is the older Vim-specific selection type for X11. Still // VIM_ATOM_NAME is the older Vim-specific selection type for X11. Still