From c28e7a2b2f23dbd246a1ad7ad7aaa6f7ab2e5887 Mon Sep 17 00:00:00 2001 From: Kenta Sato Date: Mon, 8 May 2023 18:26:03 +0100 Subject: patch 9.0.1527: crash when using negative value for term_cols Problem: Crash when using negative value for term_cols. Solution: Check for invalid term_cols value. (Kenta Sato, closes #12362) --- src/job.c | 14 ++++++++++++-- src/testdir/test_terminal.vim | 4 ++++ src/version.c | 2 ++ 3 files changed, 18 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/job.c b/src/job.c index 4e64ca3c7..2a2e53101 100644 --- a/src/job.c +++ b/src/job.c @@ -272,7 +272,8 @@ get_job_options(typval_T *tv, jobopt_T *opt, int supported, int supported2) *lp = tv_get_number(item); if (*lp < 0) { - semsg(_(e_invalid_value_for_argument_str_str), hi->hi_key, tv_get_string(item)); + semsg(_(e_invalid_value_for_argument_str_str), + hi->hi_key, tv_get_string(item)); return FAIL; } } @@ -444,10 +445,19 @@ get_job_options(typval_T *tv, jobopt_T *opt, int supported, int supported2) } else if (STRCMP(hi->hi_key, "term_cols") == 0) { + int error = FALSE; + if (!(supported2 & JO2_TERM_COLS)) break; opt->jo_set2 |= JO2_TERM_COLS; - opt->jo_term_cols = tv_get_number(item); + opt->jo_term_cols = tv_get_number_chk(item, &error); + if (error) + return FAIL; + if (opt->jo_term_cols < 0 || opt->jo_term_cols > 1000) + { + semsg(_(e_invalid_value_for_argument_str), "term_cols"); + return FAIL; + } } else if (STRCMP(hi->hi_key, "vertical") == 0) { diff --git a/src/testdir/test_terminal.vim b/src/testdir/test_terminal.vim index 596ae5d32..da263f455 100644 --- a/src/testdir/test_terminal.vim +++ b/src/testdir/test_terminal.vim @@ -617,6 +617,10 @@ func Test_terminal_size() call assert_fails("call term_start(cmd, {'term_rows': 1001})", 'E475:') call assert_fails("call term_start(cmd, {'term_rows': 10.0})", 'E805:') + call assert_fails("call term_start(cmd, {'term_cols': -1})", 'E475:') + call assert_fails("call term_start(cmd, {'term_cols': 1001})", 'E475:') + call assert_fails("call term_start(cmd, {'term_cols': 10.0})", 'E805:') + call delete('Xtext') endfunc diff --git a/src/version.c b/src/version.c index ce64da4a5..e6d27132d 100644 --- a/src/version.c +++ b/src/version.c @@ -695,6 +695,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 1527, /**/ 1526, /**/ -- cgit v1.2.1