diff options
Diffstat (limited to '')
| -rw-r--r-- | debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch | 196 |
1 files changed, 196 insertions, 0 deletions
diff --git a/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch b/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch new file mode 100644 index 0000000..ca826e0 --- /dev/null +++ b/debian/patches/upstream/patch-8.2.3402-invalid-memory-access-when-using-retab-wit.patch @@ -0,0 +1,196 @@ +From: Bram Moolenaar <Bram@vim.org> +Date: Sat, 4 Sep 2021 18:47:28 +0200 +Subject: patch 8.2.3402: invalid memory access when using :retab with large + value + +Problem: Invalid memory access when using :retab with large value. +Solution: Check the number is positive. +(cherry picked from commit b7081e135a16091c93f6f5f7525a5c58fb7ca9f9) +--- + src/ex_cmds.c | 2 +- + src/option.c | 46 +++++++++++++++++++++++++++------------------- + src/testdir/test_retab.vim | 3 +++ + src/version.c | 1 + + 4 files changed, 32 insertions(+), 20 deletions(-) + +diff --git a/src/ex_cmds.c b/src/ex_cmds.c +index 681ef42..08d71e4 100644 +--- a/src/ex_cmds.c ++++ b/src/ex_cmds.c +@@ -698,7 +698,7 @@ ex_retab(exarg_T *eap) + + #ifdef FEAT_VARTABS + new_ts_str = eap->arg; +- if (!tabstop_set(eap->arg, &new_vts_array)) ++ if (tabstop_set(eap->arg, &new_vts_array) == FAIL) + return; + while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',') + ++(eap->arg); +diff --git a/src/option.c b/src/option.c +index 4d067c0..3ebd443 100644 +--- a/src/option.c ++++ b/src/option.c +@@ -5612,9 +5612,9 @@ didset_options2(void) + #endif + #ifdef FEAT_VARTABS + vim_free(curbuf->b_p_vsts_array); +- tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array); ++ (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array); + vim_free(curbuf->b_p_vts_array); +- tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array); ++ (void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array); + #endif + } + +@@ -7551,7 +7551,7 @@ did_set_string_option( + if (errmsg == NULL) + { + int *oldarray = curbuf->b_p_vsts_array; +- if (tabstop_set(*varp, &(curbuf->b_p_vsts_array))) ++ if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK) + { + if (oldarray) + vim_free(oldarray); +@@ -7590,7 +7590,7 @@ did_set_string_option( + { + int *oldarray = curbuf->b_p_vts_array; + +- if (tabstop_set(*varp, &(curbuf->b_p_vts_array))) ++ if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK) + { + vim_free(oldarray); + #ifdef FEAT_FOLDING +@@ -11395,7 +11395,7 @@ buf_copy_options(buf_T *buf, int flags) + #ifdef FEAT_VARTABS + buf->b_p_vsts = vim_strsave(p_vsts); + if (p_vsts && p_vsts != empty_option) +- tabstop_set(p_vsts, &buf->b_p_vsts_array); ++ (void)tabstop_set(p_vsts, &buf->b_p_vsts_array); + else + buf->b_p_vsts_array = 0; + buf->b_p_vsts_nopaste = p_vsts_nopaste +@@ -11524,7 +11524,7 @@ buf_copy_options(buf_T *buf, int flags) + buf->b_p_isk = save_p_isk; + #ifdef FEAT_VARTABS + if (p_vts && p_vts != empty_option && !buf->b_p_vts_array) +- tabstop_set(p_vts, &buf->b_p_vts_array); ++ (void)tabstop_set(p_vts, &buf->b_p_vts_array); + else + buf->b_p_vts_array = NULL; + #endif +@@ -11537,7 +11537,7 @@ buf_copy_options(buf_T *buf, int flags) + #ifdef FEAT_VARTABS + buf->b_p_vts = vim_strsave(p_vts); + if (p_vts && p_vts != empty_option && !buf->b_p_vts_array) +- tabstop_set(p_vts, &buf->b_p_vts_array); ++ (void)tabstop_set(p_vts, &buf->b_p_vts_array); + else + buf->b_p_vts_array = NULL; + #endif +@@ -12435,7 +12435,7 @@ paste_option_changed(void) + if (buf->b_p_vsts_array) + vim_free(buf->b_p_vsts_array); + if (buf->b_p_vsts && buf->b_p_vsts != empty_option) +- tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array); ++ (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array); + else + buf->b_p_vsts_array = 0; + #endif +@@ -12807,18 +12807,19 @@ check_ff_value(char_u *p) + /* + * Set the integer values corresponding to the string setting of 'vartabstop'. + * "array" will be set, caller must free it if needed. ++ * Return FAIL for an error. + */ + int + tabstop_set(char_u *var, int **array) + { +- int valcount = 1; +- int t; +- char_u *cp; ++ int valcount = 1; ++ int t; ++ char_u *cp; + + if (var[0] == NUL || (var[0] == '0' && var[1] == NUL)) + { + *array = NULL; +- return TRUE; ++ return OK; + } + + for (cp = var; *cp != NUL; ++cp) +@@ -12832,8 +12833,8 @@ tabstop_set(char_u *var, int **array) + if (cp != end) + emsg(_(e_positive)); + else +- emsg(_(e_invarg)); +- return FALSE; ++ semsg(_(e_invarg2), cp); ++ return FAIL; + } + } + +@@ -12844,26 +12845,33 @@ tabstop_set(char_u *var, int **array) + ++valcount; + continue; + } +- emsg(_(e_invarg)); +- return FALSE; ++ semsg(_(e_invarg2), var); ++ return FAIL; + } + + *array = (int *)alloc((unsigned) ((valcount + 1) * sizeof(int))); + if (*array == NULL) +- return FALSE; ++ return FAIL; + (*array)[0] = valcount; + + t = 1; + for (cp = var; *cp != NUL;) + { +- (*array)[t++] = atoi((char *)cp); ++ int n = atoi((char *)cp); ++ ++ if (n < 0 || n > 9999) ++ { ++ semsg(_(e_invarg2), cp); ++ return FAIL; ++ } ++ (*array)[t++] = n; + while (*cp != NUL && *cp != ',') + ++cp; + if (*cp != NUL) + ++cp; + } + +- return TRUE; ++ return OK; + } + + /* +diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim +index f11a32b..e7b8946 100644 +--- a/src/testdir/test_retab.vim ++++ b/src/testdir/test_retab.vim +@@ -74,4 +74,7 @@ endfunc + func Test_retab_error() + call assert_fails('retab -1', 'E487:') + call assert_fails('retab! -1', 'E487:') ++ call assert_fails('ret -1000', 'E487:') ++ call assert_fails('ret 10000', 'E475:') ++ call assert_fails('ret 80000000000000000000', 'E475:') + endfunc +diff --git a/src/version.c b/src/version.c +index 6bac28e..bd19aac 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -2580,6 +2580,7 @@ static int included_patches[] = + */ + static char *(extra_patches[]) = + { /* Add your patch description below this line */ ++ "8.2.3402", + /**/ + NULL + }; |