IntenseFinance/neovim
3
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-02-25 18:55:25 -06:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.3402: invalid memory access when using :retab with large value

Browse Source 
Problem:    Invalid memory access when using :retab with large value.
Solution:   Check the number is positive.
b7081e135a
This commit is contained in:
f380cedric 2022-01-06 10:54:33 +01:00
parent f9b3b2dcfc
commit 5e81687d9a
2 changed files with 19 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/nvim/option.c
View File

@ -1993,9 +1993,9 @@ static void didset_options2(void)
// Parse default for 'wildmode'.
check_opt_wim();
xfree(curbuf->b_p_vsts_array);
tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
(void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
xfree(curbuf->b_p_vts_array);
tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
(void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
}
/// Check for string options that are NULL (normally only termcap options).
@ -6368,7 +6368,7 @@ void buf_copy_options(buf_T *buf, int flags)
buf->b_p_sts_nopaste = p_sts_nopaste;
buf->b_p_vsts = vim_strsave(p_vsts);
if (p_vsts && p_vsts != empty_option) {
tabstop_set(p_vsts, &buf->b_p_vsts_array);
(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
} else {
buf->b_p_vsts_array = 0;
}
@ -6448,7 +6448,7 @@ void buf_copy_options(buf_T *buf, int flags)
if (dont_do_help) {
buf->b_p_isk = save_p_isk;
if (p_vts && p_vts != empty_option && !buf->b_p_vts_array) {
tabstop_set(p_vts, &buf->b_p_vts_array);
(void)tabstop_set(p_vts, &buf->b_p_vts_array);
} else {
buf->b_p_vts_array = NULL;
}
@ -6458,7 +6458,7 @@ void buf_copy_options(buf_T *buf, int flags)
buf->b_p_ts = p_ts;
buf->b_p_vts = vim_strsave(p_vts);
if (p_vts && p_vts != empty_option && !buf->b_p_vts_array) {
tabstop_set(p_vts, &buf->b_p_vts_array);
(void)tabstop_set(p_vts, &buf->b_p_vts_array);
} else {
buf->b_p_vts_array = NULL;
}
@ -7151,7 +7151,7 @@ static void paste_option_changed(void)
xfree(buf->b_p_vsts_array);
}
if (buf->b_p_vsts && buf->b_p_vsts != empty_option) {
tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
} else {
buf->b_p_vsts_array = 0;
}
@ -7469,6 +7469,7 @@ int check_ff_value(char_u *p)
// Set the integer values corresponding to the string setting of 'vartabstop'.
// "array" will be set, caller must free it if needed.
// Return false for an error.
bool tabstop_set(char_u *var, long **array)
{
long valcount = 1;
@ -7488,7 +7489,7 @@ bool tabstop_set(char_u *var, long **array)
if (cp != end) {
emsg(_(e_positive));
} else {
emsg(_(e_invarg));
semsg(_(e_invarg2), cp);
}
return false;
}
@ -7501,7 +7502,7 @@ bool tabstop_set(char_u *var, long **array)
valcount++;
continue;
}
emsg(_(e_invarg));
semsg(_(e_invarg2), var);
return false;
}
@ -7510,7 +7511,13 @@ bool tabstop_set(char_u *var, long **array)
t = 1;
for (cp = var; *cp != NUL;) {
(*array)[t++] = atoi((char *)cp);
int n = atoi((char *)cp);
if (n < 0 || n > 9999) {
semsg(_(e_invarg2), cp);
return false;
}
(*array)[t++] = n;
while (*cp != NUL && *cp != ',') {
cp++;
}

3
src/nvim/testdir/test_retab.vim
View File

@ -74,4 +74,7 @@ endfunc
func Test_retab_error()
call assert_fails('retab -1', 'E487:')
call assert_fails('retab! -1', 'E487:')
call assert_fails('ret -1000', 'E487:')
call assert_fails('ret 10000', 'E475:')
call assert_fails('ret 80000000000000000000', 'E475:')
endfunc