vim-patch:8.0.0357: crash when setting 'guicursor' to weird value (#8161

) Problem: Crash when setting 'guicursor' to weird value. Solution: Avoid negative size. (Dominique Pelle, closes vim/vim#1465) vim/vim@24922ec
neovim · Mar 22, 2018 · ce3bc12 · ce3bc12
1 parent 535bf89
commit ce3bc12
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 4 deletions.
diff --git a/src/nvim/cursor_shape.c b/src/nvim/cursor_shape.c
@@ -102,11 +102,14 @@ char_u *parse_shape_opt(int what)
     }
     while (*modep != NUL) {
       colonp = vim_strchr(modep, ':');
-      if (colonp == NULL)
+      commap = vim_strchr(modep, ',');
+
+      if (colonp == NULL || (commap != NULL && commap < colonp)) {
         return (char_u *)N_("E545: Missing colon");
-      if (colonp == modep)
+      }
+      if (colonp == modep) {
         return (char_u *)N_("E546: Illegal mode");
-      commap = vim_strchr(modep, ',');
+      }
 
       // Repeat for all modes before the colon.
       // For the 'a' mode, we loop to handle all the modes.

diff --git a/src/nvim/testdir/test_options.vim b/src/nvim/testdir/test_options.vim
@@ -209,7 +209,14 @@ func Test_set_errors()
   call assert_fails('set statusline=%{', 'E540:')
   call assert_fails('set statusline=' . repeat("%p", 81), 'E541:')
   call assert_fails('set statusline=%(', 'E542:')
-  call assert_fails('set guicursor=x', 'E545:')
+  if has('cursorshape')
+    " This invalid value for 'guicursor' used to cause Vim to crash.
+    call assert_fails('set guicursor=i-ci,r-cr:h', 'E545:')
+    call assert_fails('set guicursor=i-ci', 'E545:')
+    call assert_fails('set guicursor=x', 'E545:')
+    call assert_fails('set guicursor=r-cr:horx', 'E548:')
+    call assert_fails('set guicursor=r-cr:hor0', 'E549:')
+  endif
   call assert_fails('set backupext=~ patchmode=~', 'E589:')
   call assert_fails('set winminheight=10 winheight=9', 'E591:')
   call assert_fails('set winminwidth=10 winwidth=9', 'E592:')