diff options
| author | Bram Moolenaar <Bram@vim.org> | 2017-01-29 20:31:21 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2017-01-29 20:31:21 +0100 |
| commit | d297f35eb0f6cfed47dd7ecf47df62994695a454 (patch) | |
| tree | 1c07713a2bd8728387453ad20ca970c2d2b432f9 /src | |
| parent | 80627cf51fd4274320875193a43ce11cee58c96e (diff) | |
| download | vim-git-d297f35eb0f6cfed47dd7ecf47df62994695a454.tar.gz | |
patch 8.0.0264: memory error reported by ubsanv8.0.0264
Problem: Memory error reported by ubsan, probably for using the string
returned by execute().
Solution: NUL terminate the result of execute().
Diffstat (limited to 'src')
| -rw-r--r-- | src/evalfunc.c | 12 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 13 insertions, 1 deletions
diff --git a/src/evalfunc.c b/src/evalfunc.c index 6706fe17b..7f433a5a6 100644 --- a/src/evalfunc.c +++ b/src/evalfunc.c @@ -2819,7 +2819,17 @@ f_execute(typval_T *argvars, typval_T *rettv) --list->lv_refcount; } - rettv->vval.v_string = redir_execute_ga.ga_data; + /* Need to append a NUL to the result. */ + if (ga_grow(&redir_execute_ga, 1) == OK) + { + ((char *)redir_execute_ga.ga_data)[redir_execute_ga.ga_len] = NUL; + rettv->vval.v_string = redir_execute_ga.ga_data; + } + else + { + ga_clear(&redir_execute_ga); + rettv->vval.v_string = NULL; + } msg_silent = save_msg_silent; emsg_silent = save_emsg_silent; emsg_noredir = save_emsg_noredir; diff --git a/src/version.c b/src/version.c index 67fe69b7a..5431022f4 100644 --- a/src/version.c +++ b/src/version.c @@ -765,6 +765,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 264, +/**/ 263, /**/ 262, |