Skip to content

Commit

Permalink
patch 9.0.1740: segfault when reading invalid viminfo file
Browse files Browse the repository at this point in the history
Problem: segfault when reading invalid viminfo file
Solution: Check the expected type in the viminfo file

Thanks to @yegappan for the included test.

closes: #12652
closes: #12845

Signed-off-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Pierre Colin <48397990+Pierre-Colin@users.noreply.github.com>
Co-authored-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Co-authored-by: Christian Brabandt <cb@256bit.org>
  • Loading branch information
3 people committed Aug 19, 2023
1 parent 38ab19e commit 0a07646
Show file tree
Hide file tree
Showing 3 changed files with 27 additions and 0 deletions.
20 changes: 20 additions & 0 deletions src/testdir/test_viminfo.vim
Expand Up @@ -614,6 +614,26 @@ func Test_viminfo_bad_syntax2()
rviminfo Xviminfo
endfunc

" This used to crash Vim (GitHub issue #12652)
func Test_viminfo_bad_syntax3()
let lines =<< trim END
call writefile([], 'Xvbs3.result')
qall!
END
call writefile(lines, 'Xvbs3script', 'D')

let lines = []
call add(lines, '|1,4')
" bad viminfo syntax for register barline
call add(lines, '|3,1,1,1,1,0,71489,,125') " empty line1
call writefile(lines, 'Xviminfo', 'D')

call RunVim([], [], '--clean -i Xviminfo -S Xvbs3script')
call assert_true(filereadable('Xvbs3.result'))

call delete('Xvbs3.result')
endfunc

func Test_viminfo_file_marks()
silent! bwipe test_viminfo.vim
silent! bwipe Xviminfo
Expand Down
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -695,6 +695,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
1740,
/**/
1739,
/**/
Expand Down
5 changes: 5 additions & 0 deletions src/viminfo.c
Expand Up @@ -1804,6 +1804,11 @@ handle_viminfo_register(garray_T *values, int force)
y_ptr->y_array[i] = vp[i + 6].bv_string;
vp[i + 6].bv_string = NULL;
}
else if (vp[i + 6].bv_type != BVAL_STRING)
{
free(y_ptr->y_array);
y_ptr->y_array = NULL;
}
else
y_ptr->y_array[i] = vim_strsave(vp[i + 6].bv_string);
}
Expand Down

0 comments on commit 0a07646

Please sign in to comment.