diff options
| author | Bram Moolenaar <Bram@vim.org> | 2022-01-28 20:47:49 +0000 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2022-01-28 20:47:49 +0000 |
| commit | 652dee448618589de5528a9e9a36995803f5557a (patch) | |
| tree | a659b1d0a7f5409943f2c626e2a87cde520c3733 /src/option.c | |
| parent | 14cbf77845624e4bfc28a65a5debb81864cba2cf (diff) | |
| download | vim-git-652dee448618589de5528a9e9a36995803f5557a.tar.gz | |
patch 8.2.4245: ":retab 0" may cause illegal memory accessv8.2.4245
Problem: ":retab 0" may cause illegal memory access.
Solution: Limit the value of 'tabstop' to 10000.
Diffstat (limited to 'src/option.c')
| -rw-r--r-- | src/option.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/src/option.c b/src/option.c index bb952fee5..482e960b2 100644 --- a/src/option.c +++ b/src/option.c @@ -3752,6 +3752,11 @@ set_num_option( errmsg = e_argument_must_be_positive; curbuf->b_p_ts = 8; } + else if (curbuf->b_p_ts > TABSTOP_MAX) + { + errmsg = e_invalid_argument; + curbuf->b_p_ts = 8; + } if (p_tm < 0) { errmsg = e_argument_must_be_positive; @@ -5983,7 +5988,7 @@ buf_copy_options(buf_T *buf, int flags) if (p_vsts && p_vsts != empty_option) (void)tabstop_set(p_vsts, &buf->b_p_vsts_array); else - buf->b_p_vsts_array = 0; + buf->b_p_vsts_array = NULL; buf->b_p_vsts_nopaste = p_vsts_nopaste ? vim_strsave(p_vsts_nopaste) : NULL; #endif @@ -6803,9 +6808,7 @@ paste_option_changed(void) if (buf->b_p_vsts) free_string_option(buf->b_p_vsts); buf->b_p_vsts = empty_option; - if (buf->b_p_vsts_array) - vim_free(buf->b_p_vsts_array); - buf->b_p_vsts_array = 0; + VIM_CLEAR(buf->b_p_vsts_array); #endif } @@ -6851,12 +6854,11 @@ paste_option_changed(void) free_string_option(buf->b_p_vsts); buf->b_p_vsts = buf->b_p_vsts_nopaste ? vim_strsave(buf->b_p_vsts_nopaste) : empty_option; - if (buf->b_p_vsts_array) - vim_free(buf->b_p_vsts_array); + vim_free(buf->b_p_vsts_array); if (buf->b_p_vsts && buf->b_p_vsts != empty_option) (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array); else - buf->b_p_vsts_array = 0; + buf->b_p_vsts_array = NULL; #endif } |