IntenseFinance/neovim
3
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-02-25 18:55:25 -06:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.0.1499: using uninitialized memory with fuzzy matching (#23399)

Browse Source 
Problem:    Using uninitialized memory with fuzzy matching.
Solution:   Initialize the arrays used to store match positions.

caf642c25d

Co-authored-by: Bram Moolenaar <Bram@vim.org>
This commit is contained in:
zeertzjq 2023-04-30 08:27:38 +08:00 committed by GitHub
parent c194acbfc4
commit ab7dcefbeb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 36 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/nvim/quickfix.c
View File

@ -5215,7 +5215,10 @@ static bool vgr_match_buflines(qf_list_T *qfl, char *fname, buf_T *buf, char *sp
FUNC_ATTR_NONNULL_ARG(1, 3, 4, 5, 6)
{
bool found_match = false;
const size_t pat_len = strlen(spat);
size_t pat_len = strlen(spat);
if (pat_len > MAX_FUZZY_MATCHES) {
pat_len = MAX_FUZZY_MATCHES;
}
for (linenr_T lnum = 1; lnum <= buf->b_ml.ml_line_count && *tomatch > 0; lnum++) {
colnr_T col = 0;
@ -5263,6 +5266,7 @@ static bool vgr_match_buflines(qf_list_T *qfl, char *fname, buf_T *buf, char *sp
const size_t sz = sizeof(matches) / sizeof(matches[0]);
// Fuzzy string match
CLEAR_FIELD(matches);
while (fuzzy_match(str + col, spat, false, &score, matches, (int)sz) > 0) {
// Pass the buffer number so that it gets used even for a
// dummy buffer, unless duplicate_name is set, then the

6
src/nvim/search.c
View File

@ -3045,6 +3045,10 @@ static int fuzzy_match_recursive(const char *fuzpat, const char *str, uint32_t s
return 0;
}
int recursiveScore = 0;
uint32_t recursiveMatches[MAX_FUZZY_MATCHES];
CLEAR_FIELD(recursiveMatches);
// "Copy-on-Write" srcMatches into matches
if (first_match && srcMatches != NULL) {
memcpy(matches, srcMatches, (size_t)nextMatch * sizeof(srcMatches[0]));
@ -3052,8 +3056,6 @@ static int fuzzy_match_recursive(const char *fuzpat, const char *str, uint32_t s
}
// Recursive call that "skips" this match
uint32_t recursiveMatches[MAX_FUZZY_MATCHES];
int recursiveScore = 0;
const char *const next_char = str + utfc_ptr2len(str);
if (fuzzy_match_recursive(fuzpat, next_char, strIdx + 1, &recursiveScore, strBegin, strLen,
matches, recursiveMatches,

27
test/old/testdir/test_matchfuzzy.vim
View File

@ -2,6 +2,7 @@
source shared.vim
source check.vim
source term_util.vim
" Test for matchfuzzy()
func Test_matchfuzzy()
@ -260,4 +261,30 @@ func Test_matchfuzzy_limit()
call assert_equal([{'id': 5, 'val': 'crayon'}], l->matchfuzzy('c', #{key: 'val', limit: 1}))
endfunc
" This was using uninitialized memory
func Test_matchfuzzy_initialized()
CheckRunVimInTerminal
" This can take a very long time (esp. when using valgrind). Run in a
" separate Vim instance and kill it after two seconds. We only check for
" memory errors.
let lines =<< trim END
lvimgrep [ss [fg*
END
call writefile(lines, 'XTest_matchfuzzy', 'D')
let buf = RunVimInTerminal('-u NONE -X -Z', {})
call term_sendkeys(buf, ":source XTest_matchfuzzy\n")
call TermWait(buf, 2000)
let job = term_getjob(buf)
if job_status(job) == "run"
call job_stop(job, "int")
call TermWait(buf, 50)
endif
" clean up
call StopVimInTerminal(buf)
endfunc
" vim: shiftwidth=2 sts=2 expandtab