Permalink
Browse files

patch 8.0.0537: illegal memory access with :z and large count

Problem:    Illegal memory access with :z and large count.
Solution:   Check for number overflow, using long instead of int. (Dominique
            Pelle, closes #1612)
  • Loading branch information...
brammool committed Apr 2, 2017
1 parent 69f40be commit fa0ad0bb0b4255e64ebcf9269d60a942e0ae7ff9
Showing with 92 additions and 5 deletions.
  1. +2 −1 src/Makefile
  2. +7 −2 src/ex_cmds.c
  3. +3 −2 src/testdir/test_alot.vim
  4. +78 −0 src/testdir/test_ex_z.vim
  5. +2 −0 src/version.c
View
@@ -2122,10 +2122,10 @@ test_arglist \
test_delete \
test_diffmode \
test_digraph \
test_functions \
test_display \
test_edit \
test_ex_undo \
test_ex_z \
test_execute_func \
test_expand \
test_expand_dllpath \
@@ -2142,6 +2142,7 @@ test_arglist \
test_fnameescape \
test_fnamemodify \
test_fold \
test_functions \
test_ga \
test_gf \
test_glob2regpat \
View
@@ -4564,7 +4564,7 @@ ex_change(exarg_T *eap)
ex_z(exarg_T *eap)
{
char_u *x;
int bigness;
long bigness;
char_u *kind;
int minus = 0;
linenr_T start, end, curs, i;
@@ -4601,7 +4601,12 @@ ex_z(exarg_T *eap)
}
else
{
bigness = atoi((char *)x);
bigness = atol((char *)x);
/* bigness could be < 0 if atol(x) overflows. */
if (bigness > 2 * curbuf->b_ml.ml_line_count || bigness < 0)
bigness = 2 * curbuf->b_ml.ml_line_count;
p_window = bigness;
if (*kind == '=')
bigness += 2;
@@ -8,10 +8,11 @@ source test_changedtick.vim
source test_cursor_func.vim
source test_delete.vim
source test_ex_undo.vim
source test_ex_z.vim
source test_execute_func.vim
source test_expand.vim
source test_expr.vim
source test_expand_dllpath.vim
source test_expr.vim
source test_feedkeys.vim
source test_file_perm.vim
source test_fileformat.vim
@@ -30,9 +31,9 @@ source test_join.vim
source test_jumps.vim
source test_lambda.vim
source test_lispwords.vim
source test_mapping.vim
source test_match.vim
source test_menu.vim
source test_mapping.vim
source test_messages.vim
source test_partial.vim
source test_popup.vim
View
@@ -0,0 +1,78 @@
" Test :z
func Test_z()
call setline(1, range(1, 100))
let a = execute('20z3')
call assert_equal("\n20\n21\n22", a)
call assert_equal(22, line('.'))
" 'window' should be set to the {count} value.
call assert_equal(3, &window)
" If there is only one window, then twice the amount of 'scroll' is used.
set scroll=2
let a = execute('20z')
call assert_equal("\n20\n21\n22\n23", a)
call assert_equal(23, line('.'))
let a = execute('20z+3')
" FIXME: I would expect the same result as '20z3' but it
" gives "\n21\n22\n23" instead. Bug in Vim or in ":help :z"?
"call assert_equal("\n20\n21\n22", a)
"call assert_equal(22, line('.'))
let a = execute('20z-3')
call assert_equal("\n18\n19\n20", a)
call assert_equal(20, line('.'))
let a = execute('20z=3')
call assert_match("^\n18\n19\n-\\+\n20\n-\\+\n21\n22$", a)
call assert_equal(20, line('.'))
let a = execute('20z^3')
call assert_equal("\n14\n15\n16\n17", a)
call assert_equal(17, line('.'))
let a = execute('20z.3')
call assert_equal("\n19\n20\n21", a)
call assert_equal(21, line('.'))
let a = execute('20z#3')
call assert_equal("\n 20 20\n 21 21\n 22 22", a)
call assert_equal(22, line('.'))
let a = execute('20z#-3')
call assert_equal("\n 18 18\n 19 19\n 20 20", a)
call assert_equal(20, line('.'))
let a = execute('20z#=3')
call assert_match("^\n 18 18\n 19 19\n-\\+\n 20 20\n-\\+\n 21 21\n 22 22$", a)
call assert_equal(20, line('.'))
" Test with {count} bigger than the number of lines in buffer.
let a = execute('20z1000')
call assert_match("^\n20\n21\n.*\n99\n100$", a)
call assert_equal(100, line('.'))
let a = execute('20z-1000')
call assert_match("^\n1\n2\n.*\n19\n20$", a)
call assert_equal(20, line('.'))
let a = execute('20z=1000')
call assert_match("^\n1\n.*\n-\\+\n20\n-\\\+\n.*\n100$", a)
call assert_equal(20, line('.'))
call assert_fails('20z=a', 'E144:')
set window& scroll&
bw!
endfunc
func Test_z_bug()
" This used to access invalid memory as a result of an integer overflow
" and freeze vim.
normal ox
normal Heat
z777777776666666
')
endfunc
View
@@ -764,6 +764,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
537,
/**/
536,
/**/

0 comments on commit fa0ad0b

Please sign in to comment.