Mercurial > vim
comparison src/term.c @ 15782:5de143c7cd76 v8.1.0898
patch 8.1.0898: a messed up rgb.txt can crash Vim
commit https://github.com/vim/vim/commit/0ea21e41c6789c356762f970ecf168a897dcf8b6
Author: Bram Moolenaar <Bram@vim.org>
Date: Tue Feb 12 20:46:48 2019 +0100
patch 8.1.0898: a messed up rgb.txt can crash Vim
Problem: A messed up rgb.txt can crash Vim. (Pavel Cheremushkin)
Solution: Limit to 10000 entries. Also don't retry many times when the file
cannot be read.
author | Bram Moolenaar <Bram@vim.org> |
---|---|
date | Tue, 12 Feb 2019 21:00:09 +0100 |
parents | 62b3805506b3 |
children | acd4fc05422b |
comparison
equal
deleted
inserted
replaced
15781:650911968ad2 | 15782:5de143c7cd76 |
---|---|
6983 for (i = 0; i < (int)(sizeof(rgb_table) / sizeof(rgb_table[0])); i++) | 6983 for (i = 0; i < (int)(sizeof(rgb_table) / sizeof(rgb_table[0])); i++) |
6984 if (STRICMP(name, rgb_table[i].color_name) == 0) | 6984 if (STRICMP(name, rgb_table[i].color_name) == 0) |
6985 return rgb_table[i].color; | 6985 return rgb_table[i].color; |
6986 | 6986 |
6987 /* | 6987 /* |
6988 * Last attempt. Look in the file "$VIM/rgb.txt". | 6988 * Last attempt. Look in the file "$VIMRUNTIME/rgb.txt". |
6989 */ | 6989 */ |
6990 if (size == 0) | 6990 if (size == 0) |
6991 { | 6991 { |
6992 int counting; | 6992 int counting; |
6993 | 6993 |
6994 /* colornames_table not yet initialized */ | 6994 // colornames_table not yet initialized |
6995 fname = expand_env_save((char_u *)"$VIMRUNTIME/rgb.txt"); | 6995 fname = expand_env_save((char_u *)"$VIMRUNTIME/rgb.txt"); |
6996 if (fname == NULL) | 6996 if (fname == NULL) |
6997 return INVALCOLOR; | 6997 return INVALCOLOR; |
6998 | 6998 |
6999 fd = fopen((char *)fname, "rt"); | 6999 fd = fopen((char *)fname, "rt"); |
7000 vim_free(fname); | 7000 vim_free(fname); |
7001 if (fd == NULL) | 7001 if (fd == NULL) |
7002 { | 7002 { |
7003 if (p_verbose > 1) | 7003 if (p_verbose > 1) |
7004 verb_msg(_("Cannot open $VIMRUNTIME/rgb.txt")); | 7004 verb_msg(_("Cannot open $VIMRUNTIME/rgb.txt")); |
7005 size = -1; // don't try again | |
7005 return INVALCOLOR; | 7006 return INVALCOLOR; |
7006 } | 7007 } |
7007 | 7008 |
7008 for (counting = 1; counting >= 0; --counting) | 7009 for (counting = 1; counting >= 0; --counting) |
7009 { | 7010 { |
7048 } | 7049 } |
7049 colornames_table[size].color_name = s; | 7050 colornames_table[size].color_name = s; |
7050 colornames_table[size].color = (guicolor_T)RGB(r, g, b); | 7051 colornames_table[size].color = (guicolor_T)RGB(r, g, b); |
7051 } | 7052 } |
7052 size++; | 7053 size++; |
7054 | |
7055 // The distributed rgb.txt has less than 1000 entries. Limit to | |
7056 // 10000, just in case the file was messed up. | |
7057 if (size == 10000) | |
7058 break; | |
7053 } | 7059 } |
7054 } | 7060 } |
7055 fclose(fd); | 7061 fclose(fd); |
7056 } | 7062 } |
7057 | 7063 |