forked from aniani/vim
patch 9.0.2112: [security]: overflow in shift_line
Problem: [security]: overflow in shift_line Solution: allow a max indent of INT_MAX [security]: overflow in shift_line When shifting lines in operator pending mode and using a very large value, we may overflow the size of integer. Fix this by using a long variable, testing if the result would be larger than INT_MAX and if so, indent by INT_MAX value. Special case: We cannot use long here, since on 32bit architectures (or on Windows?), it typically cannot take larger values than a plain int, so we have to use long long count, decide whether the resulting multiplication of the shiftwidth value * amount is larger than INT_MAX and if so, we will store INT_MAX as possible larges value in the long long count variable. Then we can safely cast it back to int when calling the functions to set the indent (set_indent() or change_indent()). So this should be safe. Add a test that when using a huge value in operator pending mode for shifting, we will shift by INT_MAX closes: #13535 Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
@@ -275,4 +275,15 @@ func Test_formatting_keeps_first_line_indent()
|
||||
bwipe!
|
||||
endfunc
|
||||
|
||||
" Test for indenting with large amount, causes overflow
|
||||
func Test_indent_overflow_count()
|
||||
new
|
||||
setl sw=8
|
||||
call setline(1, "abc")
|
||||
norm! V2147483647>
|
||||
" indents by INT_MAX
|
||||
call assert_equal(2147483647, indent(1))
|
||||
close!
|
||||
endfunc
|
||||
|
||||
" vim: shiftwidth=2 sts=2 expandtab
|
||||
|
||||
Reference in New Issue
Block a user