aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-07-25 10:54:51 -04:00
Code

patch 8.1.0404: accessing invalid memory with long argument name

Browse Source 
Problem:    Accessing invalid memory with long argument name.
Solution:   Use item_count instead of checking for a terminating NULL.
            (Dominique Pelle, closes #3444)
This commit is contained in:
Bram Moolenaar 2018-09-18 21:51:47 +02:00
parent cc3a997746
commit e961cba3cb
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/testdir/test_arglist.vim
View File

@ -411,3 +411,10 @@ func Test_arg_all_expand()
call assert_equal('notexist Xx\ x runtest.vim', expand('##')) call assert_equal('notexist Xx\ x runtest.vim', expand('##'))
call delete('Xx x') call delete('Xx x')
endfunc endfunc
func Test_large_arg()
" Argument longer or equal to the number of columns used to cause
" access to invalid memory.
exe 'argadd ' .repeat('x', &columns)
args
endfunc

4
src/version.c
View File

@ -794,6 +794,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
404,
/**/ /**/
403, 403,
/**/ /**/
@ -1725,7 +1727,7 @@ list_in_columns(char_u **items, int size, int current)
if (Columns < width) if (Columns < width)
{ {
/* Not enough screen columns - show one per line */ /* Not enough screen columns - show one per line */
for (i = 0; items[i] != NULL; ++i) for (i = 0; i < item_count; ++i)
{ {
version_msg_wrap(items[i], i == current); version_msg_wrap(items[i], i == current);
if (msg_col > 0) if (msg_col > 0)