Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possible NPD error #3711

Closed
5hadowblad3 opened this issue Dec 24, 2018 · 7 comments
Closed

Possible NPD error #3711

5hadowblad3 opened this issue Dec 24, 2018 · 7 comments

Comments

@5hadowblad3
Copy link

Hi, recently I use fuzzing to check the vim and I find an NPD problem.
In src/libvterm/src/termscreen.c
image
This could return a null pointer for the caller function vterm_obtain_screen and store in the vt->screen.
image
This null screen is return to create_vterm function in src/terminal.c
image
then again in vterm_screen_set_callbacks function defined in src/libvterm/src/termscreen.c
image
The callback function is set to a null pointer screen.
The potential problem is that you can set a callback function to a predefined NULL memory address which might lead to more problem.

I wonder this is a true problem in vim or not, could you help to verify it?

I am looking forward to your reply!

@chrisbra
Copy link
Member

As this comes from libvterm, cc @leonerd

@brammool
Copy link
Member

The check for vterm_obtain_state() to return null is bogus, that function never returns null.

@5hadowblad3
Copy link
Author

Is it possible that when memory resource is limited then the return value is NULL?

@5hadowblad3
Copy link
Author

image
Because it relies on the memory allocation return value.

@brammool
Copy link
Member

brammool commented Dec 24, 2018 via email

@chrisbra
Copy link
Member

I suppose this is fixed by cd929f7?

@brammool
Copy link
Member

Yes, now vterm_obtain_state() can return NULL.
It no longer crashes in out-of-memory situations.
Since the state is created when creating the vterm, this should work OK for Vim.
Not in general for libvterm though.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants