vim-patch:8.2.4975: recursive command line loop may cause a crash (#18614)

Problem:    Recursive command line loop may cause a crash.
Solution:   Limit recursion of getcmdline().
51f0bfb88a

Cherry-pick e_command_too_recursive from patch 8.2.3957.
This commit is contained in:
zeertzjq 2022-05-18 08:21:24 +08:00 committed by GitHub
parent 38cbca3eea
commit 7ded303d68
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 24 additions and 4 deletions

View File

@ -345,7 +345,7 @@ int do_cmdline(char *cmdline, LineGetter fgetline, void *cookie, int flags)
// here. The value of 200 allows nested function calls, ":source", etc.
// Allow 200 or 'maxfuncdepth', whatever is larger.
if (call_depth >= 200 && call_depth >= p_mfd) {
emsg(_("E169: Command too recursive"));
emsg(_(e_command_too_recursive));
// When converting to an exception, we do not include the command name
// since this is not an error of the specific command.
do_errthrow((cstack_T *)NULL, NULL);

View File

@ -804,6 +804,12 @@ static uint8_t *command_line_enter(int firstc, long count, int indent, bool init
ccline.cmdlen = s->indent;
}
if (cmdline_level == 50) {
// Somehow got into a loop recursively calling getcmdline(), bail out.
emsg(_(e_command_too_recursive));
goto theend;
}
ExpandInit(&s->xpc);
ccline.xpc = &s->xpc;
@ -995,12 +1001,13 @@ static uint8_t *command_line_enter(int firstc, long count, int indent, bool init
State = s->save_State;
setmouse();
ui_cursor_shape(); // may show different cursor shape
sb_text_end_cmdline();
theend:
xfree(s->save_p_icm);
xfree(ccline.last_colors.cmdbuff);
kv_destroy(ccline.last_colors.colors);
sb_text_end_cmdline();
char_u *p = ccline.cmdbuff;
if (ui_has(kUICmdline)) {

View File

@ -877,7 +877,8 @@ EXTERN char e_api_spawn_failed[] INIT(= N_("E903: Could not spawn API job"));
EXTERN char e_argreq[] INIT(= N_("E471: Argument required"));
EXTERN char e_backslash[] INIT(= N_("E10: \\ should be followed by /, ? or &"));
EXTERN char e_cmdwin[] INIT(= N_("E11: Invalid in command-line window; <CR> executes, CTRL-C quits"));
EXTERN char e_curdir[] INIT(= N_( "E12: Command not allowed from exrc/vimrc in current dir or tag search"));
EXTERN char e_curdir[] INIT(= N_("E12: Command not allowed from exrc/vimrc in current dir or tag search"));
EXTERN char e_command_too_recursive[] INIT(= N_("E169: Command too recursive"));
EXTERN char e_endif[] INIT(= N_("E171: Missing :endif"));
EXTERN char e_endtry[] INIT(= N_("E600: Missing :endtry"));
EXTERN char e_endwhile[] INIT(= N_("E170: Missing :endwhile"));

View File

@ -1224,4 +1224,16 @@ func Test_screenpos_and_completion()
call feedkeys(":let a\<C-R>=Check_completion()\<CR>\<Esc>", "xt")
endfunc
func Test_recursive_register()
let @= = ''
silent! ?e/
let caught = 'no'
try
normal //
catch /E169:/
let caught = 'yes'
endtry
call assert_equal('yes', caught)
endfunc
" vim: shiftwidth=2 sts=2 expandtab