vim-patch:8.0.0355: using uninitialized memory when 'isfname' is empty (#8493)

Problem:    Using uninitialized memory when 'isfname' is empty.
Solution:   Don't call getpwnam() without an argument. (Dominique Pelle,
            closes vim/vim#1464)
187a4f2814
This commit is contained in:
Jan Edmund Lazo 2018-06-08 02:10:38 -04:00 committed by Justin M. Keyes
parent 4871f26c22
commit be68f218ff
3 changed files with 17 additions and 9 deletions

View File

@ -76,7 +76,7 @@ char *os_get_user_directory(const char *name)
{ {
#if defined(HAVE_GETPWNAM) && defined(HAVE_PWD_H) #if defined(HAVE_GETPWNAM) && defined(HAVE_PWD_H)
struct passwd *pw; struct passwd *pw;
if (name == NULL) { if (name == NULL || *name == NUL) {
return NULL; return NULL;
} }
pw = getpwnam(name); // NOLINT(runtime/threadsafe_fn) pw = getpwnam(name); // NOLINT(runtime/threadsafe_fn)

View File

@ -1097,17 +1097,18 @@ static bool has_env_var(char_u *p)
} }
#ifdef SPECIAL_WILDCHAR #ifdef SPECIAL_WILDCHAR
/*
* Return TRUE if "p" contains a special wildcard character. // Return TRUE if "p" contains a special wildcard character, one that Vim
* Allowing for escaping. // cannot expand, requires using a shell.
*/
static bool has_special_wildchar(char_u *p) static bool has_special_wildchar(char_u *p)
{ {
for (; *p; mb_ptr_adv(p)) { for (; *p; mb_ptr_adv(p)) {
if (*p == '\\' && p[1] != NUL) // Allow for escaping
++p; if (*p == '\\' && p[1] != NUL) {
else if (vim_strchr((char_u *)SPECIAL_WILDCHAR, *p) != NULL) p++;
} else if (vim_strchr((char_u *)SPECIAL_WILDCHAR, *p) != NULL) {
return true; return true;
}
} }
return false; return false;
} }
@ -2033,7 +2034,7 @@ int expand_wildcards(int num_pat, char_u **pat, int *num_files, char_u ***files,
break; break;
} }
if (match_file_list(p_wig, (*files)[i], ffname)) { if (match_file_list(p_wig, (*files)[i], ffname)) {
// remove this matching files from the list // remove this matching file from the list
xfree((*files)[i]); xfree((*files)[i]);
for (j = i; j + 1 < *num_files; j++) { for (j = i; j + 1 < *num_files; j++) {
(*files)[j] = (*files)[j + 1]; (*files)[j] = (*files)[j + 1];

View File

@ -22,6 +22,13 @@ function! Test_whichwrap()
set whichwrap& set whichwrap&
endfunction endfunction
function! Test_isfname()
" This used to cause Vim to access uninitialized memory.
set isfname=
call assert_equal("~X", expand("~X"))
set isfname&
endfunction
function! Test_options() function! Test_options()
let caught = 'ok' let caught = 'ok'
try try