aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-23 03:43:49 -04:00
Code Activity

patch 8.2.3402: invalid memory access when using :retab with large value

Browse Source 
Problem:    Invalid memory access when using :retab with large value.
Solution:   Check the number is positive.
This commit is contained in:
Bram Moolenaar
2021-09-04 18:47:28 +02:00
parent 10c83dde55
commit b7081e135a
5 changed files with 34 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
src/indent.c
View File

@@ -18,18 +18,19 @@
/*
* Set the integer values corresponding to the string setting of 'vartabstop'.
* "array" will be set, caller must free it if needed.
* Return FAIL for an error.
*/
int
tabstop_set(char_u *var, int **array)
{
int valcount = 1;
int t;
char_u *cp;
int valcount = 1;
int t;
char_u *cp;
if (var[0] == NUL || (var[0] == '0' && var[1] == NUL))
{
*array = NULL;
return TRUE;
return OK;
}
for (cp = var; *cp != NUL; ++cp)
@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array)
if (cp != end)
emsg(_(e_positive));
else
emsg(_(e_invarg));
return FALSE;
semsg(_(e_invarg2), cp);
return FAIL;
}
}
@@ -55,26 +56,33 @@ tabstop_set(char_u *var, int **array)
++valcount;
continue;
}
emsg(_(e_invarg));
return FALSE;
semsg(_(e_invarg2), var);
return FAIL;
}
*array = ALLOC_MULT(int, valcount + 1);
if (*array == NULL)
return FALSE;
return FAIL;
(*array)[0] = valcount;
t = 1;
for (cp = var; *cp != NUL;)
{
(*array)[t++] = atoi((char *)cp);
while (*cp != NUL && *cp != ',')
int n = atoi((char *)cp);
if (n < 0 || n > 9999)
{
semsg(_(e_invarg2), cp);
return FAIL;
}
(*array)[t++] = n;
while (*cp != NUL && *cp != ',')
++cp;
if (*cp != NUL)
++cp;
}
return TRUE;
return OK;
}
/*
@@ -1591,7 +1599,7 @@ ex_retab(exarg_T *eap)
#ifdef FEAT_VARTABS
new_ts_str = eap->arg;
if (!tabstop_set(eap->arg, &new_vts_array))
if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
return;
while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
++(eap->arg);