diff options
| author | Bram Moolenaar <Bram@vim.org> | 2022-08-27 21:52:52 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2022-08-27 21:52:52 +0100 |
| commit | beedd0a266cfe524fe2a851caec8316f2e37885c (patch) | |
| tree | d53c22a482f4c48ff04a26a8f55f582e86732cf6 | |
| parent | 9198de3ae2bd20ac51d580c44f2b43c282c1e773 (diff) | |
| download | vim-git-beedd0a266cfe524fe2a851caec8316f2e37885c.tar.gz | |
patch 9.0.0289: invalid memory writev9.0.0289
Problem: Invalid memory write.
Solution: Do not put NUL in a static string.
| -rw-r--r-- | src/message.c | 29 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 26 insertions, 5 deletions
diff --git a/src/message.c b/src/message.c index 00ad2c7d3..108ea22f7 100644 --- a/src/message.c +++ b/src/message.c @@ -2237,20 +2237,41 @@ msg_puts_attr_len(char *str, int maxlen, int attr) static void put_msg_win(win_T *wp, int where, char_u *t_s, char_u *end, linenr_T lnum) { - int c = *end; + char_u *p; - *end = NUL; if (where == PUT_BELOW) - ml_append_buf(wp->w_buffer, lnum, t_s, (colnr_T)0, FALSE); + { + if (*end != NUL) + { + p = vim_strnsave(t_s, end - t_s); + if (p == NULL) + return; + } + else + p = t_s; + ml_append_buf(wp->w_buffer, lnum, p, (colnr_T)0, FALSE); + if (p != t_s) + vim_free(p); + } else { char_u *newp; curbuf = wp->w_buffer; if (where == PUT_APPEND) + { newp = concat_str(ml_get(lnum), t_s); + if (newp == NULL) + return; + if (*end != NUL) + newp[STRLEN(ml_get(lnum)) + (end - t_s)] = NUL; + } else + { newp = vim_strnsave(t_s, end - t_s); + if (newp == NULL) + return; + } ml_replace(lnum, newp, FALSE); curbuf = curwin->w_buffer; } @@ -2258,8 +2279,6 @@ put_msg_win(win_T *wp, int where, char_u *t_s, char_u *end, linenr_T lnum) // set msg_col so that a newline is written if needed msg_col = STRLEN(t_s); - - *end = c; } #endif diff --git a/src/version.c b/src/version.c index b517fe747..32c132ca4 100644 --- a/src/version.c +++ b/src/version.c @@ -708,6 +708,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 289, +/**/ 288, /**/ 287, |