diff options
| author | Bram Moolenaar <Bram@vim.org> | 2018-02-04 16:38:47 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2018-02-04 16:38:47 +0100 |
| commit | 191f18bad0b5c48afa05c3e8a00f3ced993f6a38 (patch) | |
| tree | 0aed9e0d035e54bf4446623926d55b7ae524d684 | |
| parent | fef4ddd5eb8816a6607a624aa401bcfa71a63def (diff) | |
| download | vim-git-191f18bad0b5c48afa05c3e8a00f3ced993f6a38.tar.gz | |
patch 8.0.1468: illegal memory access in del_bytes()v8.0.1468
Problem: Illegal memory access in del_bytes().
Solution: Check for negative byte count. (Christian Brabandt, closes #2466)
| -rw-r--r-- | src/message.c | 6 | ||||
| -rw-r--r-- | src/misc1.c | 17 | ||||
| -rw-r--r-- | src/version.c | 2 |
3 files changed, 18 insertions, 7 deletions
diff --git a/src/message.c b/src/message.c index 211403384..17a663352 100644 --- a/src/message.c +++ b/src/message.c @@ -761,7 +761,7 @@ emsgn(char_u *s, long n) void iemsg(char_u *s) { - msg(s); + emsg(s); #ifdef ABORT_ON_INTERNAL_ERROR abort(); #endif @@ -4993,7 +4993,7 @@ vim_vsnprintf_typval( zero_padding = 0; } else - { + { /* Regular float number */ format[0] = '%'; l = 1; @@ -5016,7 +5016,7 @@ vim_vsnprintf_typval( format[l + 1] = NUL; str_arg_l = sprintf(tmp, format, f); - } + } if (remove_trailing_zeroes) { diff --git a/src/misc1.c b/src/misc1.c index 726500a4c..593dce1c3 100644 --- a/src/misc1.c +++ b/src/misc1.c @@ -2457,7 +2457,7 @@ del_chars(long count, int fixpos) * If "fixpos" is TRUE, don't leave the cursor on the NUL after the line. * Caller must have prepared for undo. * - * return FAIL for failure, OK otherwise + * Return FAIL for failure, OK otherwise. */ int del_bytes( @@ -2476,12 +2476,21 @@ del_bytes( oldp = ml_get(lnum); oldlen = (int)STRLEN(oldp); - /* - * Can't do anything when the cursor is on the NUL after the line. - */ + /* Can't do anything when the cursor is on the NUL after the line. */ if (col >= oldlen) return FAIL; + /* If "count" is zero there is nothing to do. */ + if (count == 0) + return OK; + + /* If "count" is negative the caller must be doing something wrong. */ + if (count < 1) + { + IEMSGN("E950: Invalid count for del_bytes(): %ld", count); + return FAIL; + } + #ifdef FEAT_MBYTE /* If 'delcombine' is set and deleting (less than) one character, only * delete the last combining character. */ diff --git a/src/version.c b/src/version.c index 767a34823..e4a4b51f8 100644 --- a/src/version.c +++ b/src/version.c @@ -772,6 +772,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 1468, +/**/ 1467, /**/ 1466, |