Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possible NPD error #3711

Closed
5hadowblad3 opened this Issue Dec 24, 2018 · 7 comments

Comments

Projects
None yet
3 participants
@5hadowblad3
Copy link

5hadowblad3 commented Dec 24, 2018

Hi, recently I use fuzzing to check the vim and I find an NPD problem.
In src/libvterm/src/termscreen.c
image
This could return a null pointer for the caller function vterm_obtain_screen and store in the vt->screen.
image
This null screen is return to create_vterm function in src/terminal.c
image
then again in vterm_screen_set_callbacks function defined in src/libvterm/src/termscreen.c
image
The callback function is set to a null pointer screen.
The potential problem is that you can set a callback function to a predefined NULL memory address which might lead to more problem.

I wonder this is a true problem in vim or not, could you help to verify it?

I am looking forward to your reply!

@chrisbra

This comment has been minimized.

Copy link
Member

chrisbra commented Dec 24, 2018

As this comes from libvterm, cc @leonerd

@brammool

This comment has been minimized.

Copy link
Contributor

brammool commented Dec 24, 2018

The check for vterm_obtain_state() to return null is bogus, that function never returns null.

@5hadowblad3

This comment has been minimized.

Copy link
Author

5hadowblad3 commented Dec 24, 2018

Is it possible that when memory resource is limited then the return value is NULL?

@5hadowblad3

This comment has been minimized.

Copy link
Author

5hadowblad3 commented Dec 24, 2018

image
Because it relies on the memory allocation return value.

@brammool

This comment has been minimized.

Copy link
Contributor

brammool commented Dec 24, 2018

@chrisbra

This comment has been minimized.

Copy link
Member

chrisbra commented Dec 24, 2018

I suppose this is fixed by cd929f7?

@brammool

This comment has been minimized.

Copy link
Contributor

brammool commented Dec 24, 2018

Yes, now vterm_obtain_state() can return NULL.
It no longer crashes in out-of-memory situations.
Since the state is created when creating the vterm, this should work OK for Vim.
Not in general for libvterm though.

@brammool brammool closed this Dec 24, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.