vim-patch:8.0.0337: invalid memory access in :recover command

Problem:    Invalid memory access in :recover command.
Solution:   Avoid access before directory name. (Dominique Pelle,
            closes vim/vim#1488)

c525e3a1c2
This commit is contained in:
Justin M. Keyes 2018-02-02 01:34:10 +01:00
parent fafe23cad7
commit 4c1afd1e83
4 changed files with 27 additions and 5 deletions

View File

@ -1330,9 +1330,12 @@ recover_names (
names[2] = (char_u *)concat_fnames((char *)dir_name, ".sw?", TRUE);
num_names = 3;
} else {
p = dir_name + STRLEN(dir_name);
if (after_pathsep((char *)dir_name, (char *)p) && p[-1] == p[-2]) {
/* Ends with '//', Use Full path for swap name */
int len = STRLEN(dir_name);
p = dir_name + len;
if (after_pathsep((char *)dir_name, (char *)p)
&& len > 1
&& p[-1] == p[-2]) {
// Ends with '//', Use Full path for swap name
tail = (char_u *)make_percent_swname((char *)dir_name, (char *)fname_res);
} else {
tail = path_tail(fname_res);
@ -3054,9 +3057,12 @@ char_u *makeswapname(char_u *fname, char_u *ffname, buf_T *buf, char_u *dir_name
#ifdef HAVE_READLINK
char_u fname_buf[MAXPATHL];
#endif
int len = STRLEN(dir_name);
s = dir_name + STRLEN(dir_name);
if (after_pathsep((char *)dir_name, (char *)s) && s[-1] == s[-2]) { /* Ends with '//', Use Full path */
s = dir_name + len;
if (after_pathsep((char *)dir_name, (char *)s)
&& len > 1
&& s[-1] == s[-2]) { // Ends with '//', Use Full path
r = NULL;
if ((s = (char_u *)make_percent_swname((char *)dir_name, (char *)fname)) != NULL) {
r = (char_u *)modname((char *)s, ".swp", FALSE);

View File

@ -85,6 +85,7 @@ NEW_TESTS ?= \
test_options.res \
test_profile.res \
test_quickfix.res \
test_recover.res \
test_retab.res \
test_scrollbind.res \
test_search.res \

View File

@ -25,6 +25,7 @@ source test_mapping.vim
source test_messages.vim
source test_partial.vim
source test_popup.vim
source test_recover.vim
source test_regexp_utf8.vim
source test_source_utf8.vim
source test_statusline.vim

View File

@ -0,0 +1,14 @@
" Test :recover
func Test_recover_root_dir()
" This used to access invalid memory.
split Xtest
set dir=/
call assert_fails('recover', 'E305:')
close!
call assert_fails('split Xtest', 'E303:')
set dir&
endfunc
" TODO: move recover tests from test78.in to here.