aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-07-25 10:54:51 -04:00
Code

patch 8.0.1503: access memory beyond end of string

Browse Source 
Problem:    Access memory beyond end of string. (Coverity)
Solution:   Keep allocated memory in separate pointer.  Avoid outputting the
            NUL character.
This commit is contained in:
Bram Moolenaar 2018-02-11 15:38:40 +01:00
parent 71a43c0137
commit cdd09aa51a
2 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/hardcopy.c
View File

@ -3382,6 +3382,7 @@ mch_print_text_out(char_u *p, int len UNUSED)
#ifdef FEAT_MBYTE #ifdef FEAT_MBYTE
int in_ascii; int in_ascii;
int half_width; int half_width;
char_u *tofree = NULL;
#endif #endif
char_width = prt_char_width; char_width = prt_char_width;
@ -3507,19 +3508,15 @@ mch_print_text_out(char_u *p, int len UNUSED)
#ifdef FEAT_MBYTE #ifdef FEAT_MBYTE
if (prt_do_conv) if (prt_do_conv)
{
/* Convert from multi-byte to 8-bit encoding */ /* Convert from multi-byte to 8-bit encoding */
p = string_convert(&prt_conv, p, &len); tofree = p = string_convert(&prt_conv, p, &len);
if (p == NULL)
p = (char_u *)"";
}
if (prt_out_mbyte) if (prt_out_mbyte)
{ {
/* Multi-byte character strings are represented more efficiently as hex /* Multi-byte character strings are represented more efficiently as hex
* strings when outputting clean 8 bit PS. * strings when outputting clean 8 bit PS.
*/ */
do while (len-- > 0)
{ {
ch = prt_hexchar[(unsigned)(*p) >> 4]; ch = prt_hexchar[(unsigned)(*p) >> 4];
ga_append(&prt_ps_buffer, ch); ga_append(&prt_ps_buffer, ch);
@ -3527,7 +3524,6 @@ mch_print_text_out(char_u *p, int len UNUSED)
ga_append(&prt_ps_buffer, ch); ga_append(&prt_ps_buffer, ch);
p++; p++;
} }
while (--len);
} }
else else
#endif #endif
@ -3574,8 +3570,7 @@ mch_print_text_out(char_u *p, int len UNUSED)
#ifdef FEAT_MBYTE #ifdef FEAT_MBYTE
/* Need to free any translated characters */ /* Need to free any translated characters */
if (prt_do_conv && (*p != NUL)) vim_free(tofree);
vim_free(p);
#endif #endif
prt_text_run += char_width; prt_text_run += char_width;

2
src/version.c
View File

@ -771,6 +771,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
1503,
/**/ /**/
1502, 1502,
/**/ /**/