Skip to content

Commit

Permalink
patch 8.1.0205: invalid memory access with invalid modeline
Browse files Browse the repository at this point in the history
Problem:    Invalid memory access with invalid modeline.
Solution:   Pass pointer limit. Add a test. (closes #3241)
  • Loading branch information
brammool committed Jul 23, 2018
1 parent 947b39e commit 9cf4b50
Show file tree
Hide file tree
Showing 5 changed files with 24 additions and 9 deletions.
1 change: 1 addition & 0 deletions src/Make_all.mak
Expand Up @@ -118,6 +118,7 @@ NEW_TESTS = \
test_messages \
test_mksession \
test_mksession_utf8 \
test_modeline \
test_nested_function \
test_netbeans \
test_normal \
Expand Down
21 changes: 12 additions & 9 deletions src/option.c
Expand Up @@ -3316,7 +3316,7 @@ static char_u *set_bool_option(int opt_idx, char_u *varp, int value, int opt_fla
static char_u *set_num_option(int opt_idx, char_u *varp, long value, char_u *errbuf, size_t errbuflen, int opt_flags);
static void check_redraw(long_u flags);
static int findoption(char_u *);
static int find_key_option(char_u *);
static int find_key_option(char_u *arg_arg, int has_lt);
static void showoptions(int all, int opt_flags);
static int optval_default(struct vimoption *, char_u *varp);
static void showoneopt(struct vimoption *, int opt_flags);
Expand Down Expand Up @@ -4492,7 +4492,7 @@ do_set(
opt_idx = findoption(arg + 1);
arg[len++] = '>'; /* restore '>' */
if (opt_idx == -1)
key = find_key_option(arg + 1);
key = find_key_option(arg + 1, TRUE);
}
else
{
Expand All @@ -4510,7 +4510,7 @@ do_set(
opt_idx = findoption(arg);
arg[len] = nextchar; /* restore nextchar */
if (opt_idx == -1)
key = find_key_option(arg);
key = find_key_option(arg, FALSE);
}

/* remember character after option name */
Expand Down Expand Up @@ -5362,7 +5362,7 @@ illegal_char(char_u *errbuf, int c)
string_to_key(char_u *arg, int multi_byte)
{
if (*arg == '<')
return find_key_option(arg + 1);
return find_key_option(arg + 1, TRUE);
if (*arg == '^')
return Ctrl_chr(arg[1]);
if (multi_byte)
Expand Down Expand Up @@ -9541,7 +9541,7 @@ get_option_value(
int key;

if (STRLEN(name) == 4 && name[0] == 't' && name[1] == '_'
&& (key = find_key_option(name)) != 0)
&& (key = find_key_option(name, FALSE)) != 0)
{
char_u key_name[2];
char_u *p;
Expand Down Expand Up @@ -9831,7 +9831,7 @@ set_option_value(
int key;

if (STRLEN(name) == 4 && name[0] == 't' && name[1] == '_'
&& (key = find_key_option(name)) != 0)
&& (key = find_key_option(name, FALSE)) != 0)
{
char_u key_name[2];

Expand Down Expand Up @@ -9952,20 +9952,23 @@ get_encoding_default(void)

/*
* Translate a string like "t_xx", "<t_xx>" or "<S-Tab>" to a key number.
* When "has_lt" is true there is a '<' before "*arg_arg".
* Returns 0 when the key is not recognized.
*/
static int
find_key_option(char_u *arg)
find_key_option(char_u *arg_arg, int has_lt)
{
int key;
int key = 0;
int modifiers;
char_u *arg = arg_arg;

/*
* Don't use get_special_key_code() for t_xx, we don't want it to call
* add_termcap_entry().
*/
if (arg[0] == 't' && arg[1] == '_' && arg[2] && arg[3])
key = TERMCAP2KEY(arg[2], arg[3]);
else
else if (has_lt)
{
--arg; /* put arg at the '<' */
modifiers = 0;
Expand Down
1 change: 1 addition & 0 deletions src/testdir/test_alot.vim
Expand Up @@ -37,6 +37,7 @@ source test_mapping.vim
source test_match.vim
source test_menu.vim
source test_messages.vim
source test_modeline.vim
source test_partial.vim
source test_popup.vim
source test_put.vim
Expand Down
8 changes: 8 additions & 0 deletions src/testdir/test_modeline.vim
@@ -0,0 +1,8 @@
" Tests for parsing the modeline.

func Test_invalid()
" This was reading before allocated memory.
call writefile(['vi:0', 'nothing'], 'Xmodeline')
call assert_fails('split Xmodeline', 'E518:')
bwipe!
endfunc
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -793,6 +793,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
205,
/**/
204,
/**/
Expand Down

0 comments on commit 9cf4b50

Please sign in to comment.