From 4fabd7dd4a2f77bc741eda58126d529f26f16a8d Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Tue, 18 Sep 2012 18:03:37 +0200 Subject: updated for version 7.3.664 Problem: Buffer overflow in unescaping text. (Raymond Ko) Solution: Limit check for multi-byte character to 4 bytes. --- src/mbyte.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'src/mbyte.c') diff --git a/src/mbyte.c b/src/mbyte.c index ca3204f21..33e894e88 100644 --- a/src/mbyte.c +++ b/src/mbyte.c @@ -3793,13 +3793,15 @@ mb_charlen_len(str, len) mb_unescape(pp) char_u **pp; { - static char_u buf[MB_MAXBYTES + 1]; - int n, m = 0; + static char_u buf[6]; + int n; + int m = 0; char_u *str = *pp; /* Must translate K_SPECIAL KS_SPECIAL KE_FILLER to K_SPECIAL and CSI - * KS_EXTRA KE_CSI to CSI. */ - for (n = 0; str[n] != NUL && m <= MB_MAXBYTES; ++n) + * KS_EXTRA KE_CSI to CSI. + * Maximum length of a utf-8 character is 4 bytes. */ + for (n = 0; str[n] != NUL && m < 4; ++n) { if (str[n] == K_SPECIAL && str[n + 1] == KS_SPECIAL @@ -3836,6 +3838,10 @@ mb_unescape(pp) *pp = str + n + 1; return buf; } + + /* Bail out quickly for ASCII. */ + if (buf[0] < 128) + break; } return NULL; } -- cgit v1.2.1