aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-25 03:54:15 -04:00
Code Activity

patch 8.2.3487: illegal memory access if buffer name is very long

Browse Source 
Problem:    Illegal memory access if buffer name is very long.
Solution:   Make sure not to go over the end of the buffer.
This commit is contained in:
Bram Moolenaar
2021-10-08 18:39:28 +01:00
parent cce81e9673
commit 826bfe4bbd
3 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/drawscreen.c
View File

@@ -464,13 +464,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
*(p + len++) = ' ';
if (bt_help(wp->w_buffer))
{
STRCPY(p + len, _("[Help]"));
vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Help]"));
len += (int)STRLEN(p + len);
}
#ifdef FEAT_QUICKFIX
if (wp->w_p_pvw)
{
STRCPY(p + len, _("[Preview]"));
vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Preview]"));
len += (int)STRLEN(p + len);
}
#endif
@@ -480,12 +480,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
#endif
)
{
STRCPY(p + len, "[+]");
len += 3;
vim_snprintf((char *)p + len, MAXPATHL - len, "%s", "[+]");
len += (int)STRLEN(p + len);
}
if (wp->w_buffer->b_p_ro)
{
STRCPY(p + len, _("[RO]"));
vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[RO]"));
len += (int)STRLEN(p + len);
}

10
src/testdir/test_statusline.vim
View File

@@ -522,4 +522,14 @@ func Test_statusline_mbyte_fillchar()
%bw!
endfunc
" Used to write beyond allocated memory. This assumes MAXPATHL is 4096 bytes.
func Test_statusline_verylong_filename()
let fname = repeat('x', 4090)
exe "new " .. fname
set buftype=help
set previewwindow
redraw
bwipe!
endfunc
" vim: shiftwidth=2 sts=2 expandtab

2
src/version.c
View File

@@ -757,6 +757,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
3487,
/**/
3486,
/**/