diff options
| author | Bram Moolenaar <Bram@vim.org> | 2020-10-13 21:11:13 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2020-10-13 21:11:13 +0200 |
| commit | b9616af23f31fc18721a92643c21f42b69854efe (patch) | |
| tree | 5bbf78403a5731ac2d8c26aa74690e73e321a9a3 | |
| parent | 21cbe175eece17fad21d7403b00422445b587138 (diff) | |
| download | vim-git-b9616af23f31fc18721a92643c21f42b69854efe.tar.gz | |
patch 8.2.1843: Netbeans: with huge buffer number memory allocation may failv8.2.1843
Problem: Netbeans: with huge buffer number memory allocation may fail.
Solution: Check for size overflow.
| -rw-r--r-- | src/netbeans.c | 12 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 12 insertions, 2 deletions
diff --git a/src/netbeans.c b/src/netbeans.c index ad049a27d..ccff3a536 100644 --- a/src/netbeans.c +++ b/src/netbeans.c @@ -674,11 +674,19 @@ nb_get_buf(int bufno) { if (bufno >= buf_list_size) // grow list { - nbbuf_T *t_buf_list = buf_list; + nbbuf_T *t_buf_list = buf_list; + size_t bufsize; incr = bufno - buf_list_size + 90; buf_list_size += incr; - buf_list = vim_realloc(buf_list, buf_list_size * sizeof(nbbuf_T)); + bufsize = buf_list_size * sizeof(nbbuf_T); + if (bufsize == 0 || bufsize / sizeof(nbbuf_T) + != (size_t)buf_list_size) + { + // list size overflow, bail out + return NULL; + } + buf_list = vim_realloc(buf_list, bufsize); if (buf_list == NULL) { vim_free(t_buf_list); diff --git a/src/version.c b/src/version.c index e32611178..0e5c4df49 100644 --- a/src/version.c +++ b/src/version.c @@ -751,6 +751,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 1843, +/**/ 1842, /**/ 1841, |