IntenseFinance/neovim
3
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-02-25 18:55:25 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(usercmd): Fix buffer overflow in uc_list() (#23225)

Browse Source 
fix(usercmd): fix buffer overflow in uc_list()

Build with: -Wp,-D_FORTIFY_SOURCE=3 -O1 and gcc 13.

*** buffer overflow detected ***: terminated

(gdb) bt
  #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
  #1  0x00007f3eb8b93c03 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
  #2  0x00007f3eb8b42aee in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
  #3  0x00007f3eb8b2b87f in __GI_abort () at abort.c:79
  #4  0x00007f3eb8b2c60f in __libc_message (fmt=fmt@entry=0x7f3eb8ca72e6 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:150
  #5  0x00007f3eb8c27b29 in __GI___fortify_fail (msg=msg@entry=0x7f3eb8ca728c "buffer overflow detected") at fortify_fail.c:24
  #6  0x00007f3eb8c26364 in __GI___chk_fail () at chk_fail.c:28
  #7  0x00007f3eb8c25f45 in ___snprintf_chk (s=s@entry=0x55b8c7c096a5 <IObuff+5> "t' item", maxlen=maxlen@entry=1025, flag=flag@entry=2, slen=slen@entry=1020, format=format@entry=0x55b8c7b872a6 "%ldc") at snprintf_chk.c:29
  #8  0x000055b8c7aea59f in snprintf (__fmt=0x55b8c7b872a6 "%ldc", __n=1025, __s=0x55b8c7c096a5 <IObuff+5> "t' item") at /usr/include/bits/stdio2.h:54
  #9  uc_list (name=name@entry=0x55b8c8351788 "Explore", name_len=name_len@entry=7) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:534
  #10 0x000055b8c7aeb8a0 in ex_command (eap=0x7fffdc350e60) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:1009
  #11 0x000055b8c7972537 in execute_cmd0 (retv=retv@entry=0x7fffdc350e54, eap=eap@entry=0x7fffdc350e60, errormsg=errormsg@entry=0x7fffdc350e58, preview=preview@entry=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:1620
  #12 0x000055b8c7975c55 in do_one_cmd (cmdlinep=cmdlinep@entry=0x7fffdc3510b8, flags=flags@entry=0, cstack=cstack@entry=0x7fffdc351140, fgetline=fgetline@entry=0x55b8c79882b8 <getexline>, cookie=cookie@entry=0x0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:2279
  #13 0x000055b8c79767fe in do_cmdline (cmdline=<optimized out>, fgetline=0x55b8c79882b8 <getexline>, cookie=0x0, flags=0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:578
  #14 0x000055b8c7a17463 in nv_colon (cap=0x7fffdc351780) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:3228
  #15 0x000055b8c7a11b35 in normal_execute (state=0x7fffdc351700, key=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:1196
  #16 0x000055b8c7ab0994 in state_enter (s=0x7fffdc351700) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/state.c:99
  #17 0x000055b8c7a0ef68 in normal_enter (cmdwin=false, noexmode=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:497
  #18 0x000055b8c78a0640 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/main.c:641
This commit is contained in:
Andreas Schneider 2023-04-21 13:16:32 +02:00 committed by GitHub
parent ebfb6399d9
commit 9e79f7433e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 24 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
src/nvim/usercmd.c
View File

@ -469,7 +469,7 @@ static void uc_list(char *name, size_t name_len)
} }
// Special cases // Special cases
int len = 4; size_t len = 4;
if (a & EX_BANG) { if (a & EX_BANG) {
msg_putchar('!'); msg_putchar('!');
len--; len--;
@ -491,7 +491,7 @@ static void uc_list(char *name, size_t name_len)
} }
msg_outtrans_attr(cmd->uc_name, HL_ATTR(HLF_D)); msg_outtrans_attr(cmd->uc_name, HL_ATTR(HLF_D));
len = (int)strlen(cmd->uc_name) + 4; len = strlen(cmd->uc_name) + 4;
do { do {
msg_putchar(' '); msg_putchar(' ');
@ -500,7 +500,7 @@ static void uc_list(char *name, size_t name_len)
// "over" is how much longer the name is than the column width for // "over" is how much longer the name is than the column width for
// the name, we'll try to align what comes after. // the name, we'll try to align what comes after.
const int over = len - 22; const int64_t over = (int64_t)len - 22;
len = 0; len = 0;
// Arguments // Arguments
@ -524,20 +524,22 @@ static void uc_list(char *name, size_t name_len)
do { do {
IObuff[len++] = ' '; IObuff[len++] = ' ';
} while (len < 5 - over); } while ((int64_t)len < 5 - over);
// Address / Range // Address / Range
if (a & (EX_RANGE | EX_COUNT)) { if (a & (EX_RANGE | EX_COUNT)) {
if (a & EX_COUNT) { if (a & EX_COUNT) {
// -count=N // -count=N
snprintf(IObuff + len, IOSIZE, "%" PRId64 "c", cmd->uc_def); int rc = snprintf(IObuff + len, IOSIZE - len, "%" PRId64 "c", cmd->uc_def);
len += (int)strlen(IObuff + len); assert(rc > 0);
len += (size_t)rc;
} else if (a & EX_DFLALL) { } else if (a & EX_DFLALL) {
IObuff[len++] = '%'; IObuff[len++] = '%';
} else if (cmd->uc_def >= 0) { } else if (cmd->uc_def >= 0) {
// -range=N // -range=N
snprintf(IObuff + len, IOSIZE, "%" PRId64 "", cmd->uc_def); int rc = snprintf(IObuff + len, IOSIZE - len, "%" PRId64 "", cmd->uc_def);
len += (int)strlen(IObuff + len); assert(rc > 0);
len += (size_t)rc;
} else { } else {
IObuff[len++] = '.'; IObuff[len++] = '.';
} }
@ -545,32 +547,34 @@ static void uc_list(char *name, size_t name_len)
do { do {
IObuff[len++] = ' '; IObuff[len++] = ' ';
} while (len < 8 - over); } while ((int64_t)len < 8 - over);
// Address Type // Address Type
for (j = 0; addr_type_complete[j].expand != ADDR_NONE; j++) { for (j = 0; addr_type_complete[j].expand != ADDR_NONE; j++) {
if (addr_type_complete[j].expand != ADDR_LINES if (addr_type_complete[j].expand != ADDR_LINES
&& addr_type_complete[j].expand == cmd->uc_addr_type) { && addr_type_complete[j].expand == cmd->uc_addr_type) {
STRCPY(IObuff + len, addr_type_complete[j].shortname); int rc = snprintf(IObuff + len, IOSIZE - len, "%s", addr_type_complete[j].shortname);
len += (int)strlen(IObuff + len); assert(rc > 0);
len += (size_t)rc;
break; break;
} }
} }
do { do {
IObuff[len++] = ' '; IObuff[len++] = ' ';
} while (len < 13 - over); } while ((int64_t)len < 13 - over);
// Completion // Completion
char *cmd_compl = get_command_complete(cmd->uc_compl); char *cmd_compl = get_command_complete(cmd->uc_compl);
if (cmd_compl != NULL) { if (cmd_compl != NULL) {
STRCPY(IObuff + len, get_command_complete(cmd->uc_compl)); int rc = snprintf(IObuff + len, IOSIZE - len, "%s", get_command_complete(cmd->uc_compl));
len += (int)strlen(IObuff + len); assert(rc > 0);
len += (size_t)rc;
} }
do { do {
IObuff[len++] = ' '; IObuff[len++] = ' ';
} while (len < 25 - over); } while ((int64_t)len < 25 - over);
IObuff[len] = '\0'; IObuff[len] = '\0';
msg_outtrans(IObuff); msg_outtrans(IObuff);

5
test/functional/ex_cmds/excmd_spec.lua
View File

@ -28,6 +28,11 @@ describe('Ex cmds', function()
assert_alive() assert_alive()
end) end)
it('listing long user command does not crash', function()
command('execute "command" repeat("T", 255) ":"')
command('command')
end)
it(':def is an unknown command #23149', function() it(':def is an unknown command #23149', function()
eq('Vim:E492: Not an editor command: def', pcall_err(command, 'def')) eq('Vim:E492: Not an editor command: def', pcall_err(command, 'def'))
eq(1, funcs.exists(':d')) eq(1, funcs.exists(':d'))