diff options
| author | Bram Moolenaar <Bram@vim.org> | 2018-02-11 15:38:40 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2018-02-11 15:38:40 +0100 |
| commit | cdd09aa51a8d34bb384460af4f91026dbff5bf48 (patch) | |
| tree | 8416a232117bb1557db7eff8b4bb48bd504a521c /src/hardcopy.c | |
| parent | 71a43c01377cb0c5cdc5f2d9a357b5ef1aa69ee3 (diff) | |
| download | vim-git-cdd09aa51a8d34bb384460af4f91026dbff5bf48.tar.gz | |
patch 8.0.1503: access memory beyond end of stringv8.0.1503
Problem: Access memory beyond end of string. (Coverity)
Solution: Keep allocated memory in separate pointer. Avoid outputting the
NUL character.
Diffstat (limited to 'src/hardcopy.c')
| -rw-r--r-- | src/hardcopy.c | 13 |
1 files changed, 4 insertions, 9 deletions
diff --git a/src/hardcopy.c b/src/hardcopy.c index 96fab2048..91f62c39f 100644 --- a/src/hardcopy.c +++ b/src/hardcopy.c @@ -3382,6 +3382,7 @@ mch_print_text_out(char_u *p, int len UNUSED) #ifdef FEAT_MBYTE int in_ascii; int half_width; + char_u *tofree = NULL; #endif char_width = prt_char_width; @@ -3507,19 +3508,15 @@ mch_print_text_out(char_u *p, int len UNUSED) #ifdef FEAT_MBYTE if (prt_do_conv) - { /* Convert from multi-byte to 8-bit encoding */ - p = string_convert(&prt_conv, p, &len); - if (p == NULL) - p = (char_u *)""; - } + tofree = p = string_convert(&prt_conv, p, &len); if (prt_out_mbyte) { /* Multi-byte character strings are represented more efficiently as hex * strings when outputting clean 8 bit PS. */ - do + while (len-- > 0) { ch = prt_hexchar[(unsigned)(*p) >> 4]; ga_append(&prt_ps_buffer, ch); @@ -3527,7 +3524,6 @@ mch_print_text_out(char_u *p, int len UNUSED) ga_append(&prt_ps_buffer, ch); p++; } - while (--len); } else #endif @@ -3574,8 +3570,7 @@ mch_print_text_out(char_u *p, int len UNUSED) #ifdef FEAT_MBYTE /* Need to free any translated characters */ - if (prt_do_conv && (*p != NUL)) - vim_free(p); + vim_free(tofree); #endif prt_text_run += char_width; |