Skip to content
Permalink
Browse files
patch 8.2.3402: invalid memory access when using :retab with large value
Problem:    Invalid memory access when using :retab with large value.
Solution:   Check the number is positive.
  • Loading branch information
brammool committed Sep 4, 2021
1 parent 10c83dd commit b7081e135a16091c93f6f5f7525a5c58fb7ca9f9
Showing with 34 additions and 21 deletions.
  1. +21 −13 src/indent.c
  2. +6 −6 src/option.c
  3. +2 −2 src/optionstr.c
  4. +3 −0 src/testdir/test_retab.vim
  5. +2 −0 src/version.c
@@ -18,18 +18,19 @@
/*
* Set the integer values corresponding to the string setting of 'vartabstop'.
* "array" will be set, caller must free it if needed.
* Return FAIL for an error.
*/
int
tabstop_set(char_u *var, int **array)
{
int valcount = 1;
int t;
char_u *cp;
int valcount = 1;
int t;
char_u *cp;

if (var[0] == NUL || (var[0] == '0' && var[1] == NUL))
{
*array = NULL;
return TRUE;
return OK;
}

for (cp = var; *cp != NUL; ++cp)
@@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array)
if (cp != end)
emsg(_(e_positive));
else
emsg(_(e_invarg));
return FALSE;
semsg(_(e_invarg2), cp);
return FAIL;
}
}

@@ -55,26 +56,33 @@ tabstop_set(char_u *var, int **array)
++valcount;
continue;
}
emsg(_(e_invarg));
return FALSE;
semsg(_(e_invarg2), var);
return FAIL;
}

*array = ALLOC_MULT(int, valcount + 1);
if (*array == NULL)
return FALSE;
return FAIL;
(*array)[0] = valcount;

t = 1;
for (cp = var; *cp != NUL;)
{
(*array)[t++] = atoi((char *)cp);
while (*cp != NUL && *cp != ',')
int n = atoi((char *)cp);

if (n < 0 || n > 9999)
{
semsg(_(e_invarg2), cp);
return FAIL;
}
(*array)[t++] = n;
while (*cp != NUL && *cp != ',')
++cp;
if (*cp != NUL)
++cp;
}

return TRUE;
return OK;
}

/*
@@ -1591,7 +1599,7 @@ ex_retab(exarg_T *eap)

#ifdef FEAT_VARTABS
new_ts_str = eap->arg;
if (!tabstop_set(eap->arg, &new_vts_array))
if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
return;
while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
++(eap->arg);
@@ -2449,9 +2449,9 @@ didset_options2(void)
#endif
#ifdef FEAT_VARTABS
vim_free(curbuf->b_p_vsts_array);
tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
(void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
vim_free(curbuf->b_p_vts_array);
tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
(void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
#endif
}

@@ -5947,7 +5947,7 @@ buf_copy_options(buf_T *buf, int flags)
buf->b_p_vsts = vim_strsave(p_vsts);
COPY_OPT_SCTX(buf, BV_VSTS);
if (p_vsts && p_vsts != empty_option)
tabstop_set(p_vsts, &buf->b_p_vsts_array);
(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
else
buf->b_p_vsts_array = 0;
buf->b_p_vsts_nopaste = p_vsts_nopaste
@@ -6107,7 +6107,7 @@ buf_copy_options(buf_T *buf, int flags)
buf->b_p_isk = save_p_isk;
#ifdef FEAT_VARTABS
if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
tabstop_set(p_vts, &buf->b_p_vts_array);
(void)tabstop_set(p_vts, &buf->b_p_vts_array);
else
buf->b_p_vts_array = NULL;
#endif
@@ -6122,7 +6122,7 @@ buf_copy_options(buf_T *buf, int flags)
buf->b_p_vts = vim_strsave(p_vts);
COPY_OPT_SCTX(buf, BV_VTS);
if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
tabstop_set(p_vts, &buf->b_p_vts_array);
(void)tabstop_set(p_vts, &buf->b_p_vts_array);
else
buf->b_p_vts_array = NULL;
#endif
@@ -6818,7 +6818,7 @@ paste_option_changed(void)
if (buf->b_p_vsts_array)
vim_free(buf->b_p_vsts_array);
if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
else
buf->b_p_vsts_array = 0;
#endif
@@ -2240,7 +2240,7 @@ did_set_string_option(
if (errmsg == NULL)
{
int *oldarray = curbuf->b_p_vsts_array;
if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)))
if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK)
{
if (oldarray)
vim_free(oldarray);
@@ -2279,7 +2279,7 @@ did_set_string_option(
{
int *oldarray = curbuf->b_p_vts_array;

if (tabstop_set(*varp, &(curbuf->b_p_vts_array)))
if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK)
{
vim_free(oldarray);
#ifdef FEAT_FOLDING
@@ -75,6 +75,9 @@ endfunc
func Test_retab_error()
call assert_fails('retab -1', 'E487:')
call assert_fails('retab! -1', 'E487:')
call assert_fails('ret -1000', 'E487:')
call assert_fails('ret 10000', 'E475:')
call assert_fails('ret 80000000000000000000', 'E475:')
endfunc

" vim: shiftwidth=2 sts=2 expandtab
@@ -755,6 +755,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
3402,
/**/
3401,
/**/

0 comments on commit b7081e1

Please sign in to comment.