Permalink
Browse files

patch 8.0.0337: invalid memory access in :recover command

Problem:    Invalid memory access in :recover command.
Solution:   Avoid access before directory name. (Dominique Pelle,
            closes #1488)
  • Loading branch information...
brammool committed Feb 18, 2017
1 parent 3df0173 commit c525e3a1c20f6b5d9809c8b84f80090a8e416c92
Showing with 26 additions and 4 deletions.
  1. +1 −0 src/Makefile
  2. +8 −4 src/memline.c
  3. +1 −0 src/testdir/test_alot.vim
  4. +14 −0 src/testdir/test_recover.vim
  5. +2 −0 src/version.c
View
@@ -2177,6 +2177,7 @@ test_arglist \
test_pyx2 \
test_pyx3 \
test_quickfix \
+ test_recover \
test_regexp_latin \
test_regexp_utf8 \
test_reltime \
View
@@ -1863,8 +1863,10 @@ recover_names(
else
{
#if defined(UNIX) || defined(WIN3264)
- p = dir_name + STRLEN(dir_name);
- if (after_pathsep(dir_name, p) && p[-1] == p[-2])
+ int len = STRLEN(dir_name);
+
+ p = dir_name + len;
+ if (after_pathsep(dir_name, p) && len > 1 && p[-1] == p[-2])
{
/* Ends with '//', Use Full path for swap name */
tail = make_percent_swname(dir_name, fname_res);
@@ -3922,8 +3924,10 @@ makeswapname(
#endif
#if defined(UNIX) || defined(WIN3264) /* Need _very_ long file names */
- s = dir_name + STRLEN(dir_name);
- if (after_pathsep(dir_name, s) && s[-1] == s[-2])
+ int len = STRLEN(dir_name);
+
+ s = dir_name + len;
+ if (after_pathsep(dir_name, s) && len > 1 && s[-1] == s[-2])
{ /* Ends with '//', Use Full path */
r = NULL;
if ((s = make_percent_swname(dir_name, fname)) != NULL)
@@ -34,6 +34,7 @@ source test_messages.vim
source test_partial.vim
source test_popup.vim
source test_put.vim
+source test_recover.vim
source test_reltime.vim
source test_searchpos.vim
source test_set.vim
@@ -0,0 +1,14 @@
+" Test :recover
+
+func Test_recover_root_dir()
+ " This used to access invalid memory.
+ split Xtest
+ set dir=/
+ call assert_fails('recover', 'E305:')
+ close!
+
+ call assert_fails('split Xtest', 'E303:')
+ set dir&
+endfunc
+
+" TODO: move recover tests from test78.in to here.
View
@@ -764,6 +764,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 337,
/**/
336,
/**/

0 comments on commit c525e3a

Please sign in to comment.