thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 9.1.0722: crash with large id in text_prop interface

Browse Source 
Problem:  crash with large id in text_prop interface
          prop_add()/prop_add_list() (cposture)
Solution: Error out if the id is > INT_MAX or <= INT_MIN

fixes: #15637
closes: #15638

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt
2024-09-08 20:05:23 +02:00
parent 5b9237c2e7
commit 701c863e68
4 changed files with 32 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/testdir/test_textprop.vim
View File

@@ -393,6 +393,8 @@ func Test_prop_add_list()
call assert_fails('call prop_add_list(test_null_dict(), [[2, 2, 2]])', 'E965:')
call assert_fails('call prop_add_list(#{type: "one"}, test_null_list())', 'E1298:')
call assert_fails('call prop_add_list(#{type: "one"}, [test_null_list()])', 'E714:')
call assert_fails('call prop_add_list(#{type: "one", id: 2147483648}, [[2, 2, 2, 2], [3, 20, 3, 22]])', 'E1510:')
call assert_fails('call prop_add_list(#{type: "one", id: -2147483648}, [[2, 2, 2, 2], [3, 20, 3, 22]])', 'E1510:')
" only one error for multiple wrong values
call assert_fails('call prop_add_list(#{type: "one"}, [[{}, [], 0z00, 0.3]])', ['E728:', 'E728:'])
@@ -1780,6 +1782,8 @@ func Test_prop_func_invalid_args()
call assert_fails("call prop_add(2, 3, {'type': 'xxx', 'length':-1})", 'E475:')
call assert_fails("call prop_add(2, 3, {'type': 'xxx', 'end_col':0})", 'E475:')
call assert_fails("call prop_add(2, 3, {'length':1})", 'E965:')
call assert_fails("call prop_add(2, 3, {'type': 'xxx', 'id': 2147483648})", 'E1510:')
call assert_fails("call prop_add(2, 3, {'type': 'xxx', 'id': -2147483648})", 'E1510:')
call prop_type_delete('xxx')
bwipe!

22
src/textprop.c
View File

@@ -372,7 +372,16 @@ f_prop_add_list(typval_T *argvars, typval_T *rettv UNUSED)
type_name = dict_get_string(dict, "type", FALSE);
if (dict_has_key(dict, "id"))
id = dict_get_number(dict, "id");
{
vimlong_T x;
x = dict_get_number(dict, "id");
if (x > INT_MAX || x <= INT_MIN)
{
semsg(_(e_val_too_large), dict_get_string(dict, "id", FALSE));
return;
}
id = (int)x;
}
if (get_bufnr_from_arg(&argvars[0], &buf) == FAIL)
return;
@@ -497,7 +506,16 @@ prop_add_common(
end_col = 1;
if (dict_has_key(dict, "id"))
id = dict_get_number(dict, "id");
{
vimlong_T x;
x = dict_get_number(dict, "id");
if (x > INT_MAX || x <= INT_MIN)
{
semsg(_(e_val_too_large), dict_get_string(dict, "id", FALSE));
goto theend;
}
id = (int)x;
}
if (dict_has_key(dict, "text"))
{

2
src/version.c
View File

@@ -704,6 +704,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
722,
/**/
721,
/**/