Mercurial > vim

comparison src/hardcopy.c @ 13258:6acb9148d83e v8.0.1503

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 8.0.1503: access memory beyond end of string commit https://github.com/vim/vim/commit/cdd09aa51a8d34bb384460af4f91026dbff5bf48 Author: Bram Moolenaar <Bram@vim.org> Date: Sun Feb 11 15:38:40 2018 +0100 patch 8.0.1503: access memory beyond end of string Problem: Access memory beyond end of string. (Coverity) Solution: Keep allocated memory in separate pointer. Avoid outputting the NUL character.
author Christian Brabandt <cb@256bit.org>
date Sun, 11 Feb 2018 15:45:05 +0100
parents ac42c4b11dbc
children 873542706b0b
comparison
equal deleted inserted replaced
13257:611480b1f7f1 13258:6acb9148d83e
3380 float char_width; 3380 float char_width;
3381 float next_pos; 3381 float next_pos;
3382 #ifdef FEAT_MBYTE 3382 #ifdef FEAT_MBYTE
3383 int in_ascii; 3383 int in_ascii;
3384 int half_width; 3384 int half_width;
3385 char_u *tofree = NULL;
3385 #endif 3386 #endif
3386 3387
3387 char_width = prt_char_width; 3388 char_width = prt_char_width;
3388 3389
3389 #ifdef FEAT_MBYTE 3390 #ifdef FEAT_MBYTE
3505 prt_attribute_change = FALSE; 3506 prt_attribute_change = FALSE;
3506 } 3507 }
3507 3508
3508 #ifdef FEAT_MBYTE 3509 #ifdef FEAT_MBYTE
3509 if (prt_do_conv) 3510 if (prt_do_conv)
3510 {
3511 /* Convert from multi-byte to 8-bit encoding */ 3511 /* Convert from multi-byte to 8-bit encoding */
3512 p = string_convert(&prt_conv, p, &len); 3512 tofree = p = string_convert(&prt_conv, p, &len);
3513 if (p == NULL)
3514 p = (char_u *)"";
3515 }
3516 3513
3517 if (prt_out_mbyte) 3514 if (prt_out_mbyte)
3518 { 3515 {
3519 /* Multi-byte character strings are represented more efficiently as hex 3516 /* Multi-byte character strings are represented more efficiently as hex
3520 * strings when outputting clean 8 bit PS. 3517 * strings when outputting clean 8 bit PS.
3521 */ 3518 */
3522 do 3519 while (len-- > 0)
3523 { 3520 {
3524 ch = prt_hexchar[(unsigned)(*p) >> 4]; 3521 ch = prt_hexchar[(unsigned)(*p) >> 4];
3525 ga_append(&prt_ps_buffer, ch); 3522 ga_append(&prt_ps_buffer, ch);
3526 ch = prt_hexchar[(*p) & 0xf]; 3523 ch = prt_hexchar[(*p) & 0xf];
3527 ga_append(&prt_ps_buffer, ch); 3524 ga_append(&prt_ps_buffer, ch);
3528 p++; 3525 p++;
3529 } 3526 }
3530 while (--len);
3531 } 3527 }
3532 else 3528 else
3533 #endif 3529 #endif
3534 { 3530 {
3535 /* Add next character to buffer of characters to output. 3531 /* Add next character to buffer of characters to output.
3572 ga_append(&prt_ps_buffer, ch); 3568 ga_append(&prt_ps_buffer, ch);
3573 } 3569 }
3574 3570
3575 #ifdef FEAT_MBYTE 3571 #ifdef FEAT_MBYTE
3576 /* Need to free any translated characters */ 3572 /* Need to free any translated characters */
3577 if (prt_do_conv && (*p != NUL)) 3573 vim_free(tofree);
3578 vim_free(p);
3579 #endif 3574 #endif
3580 3575
3581 prt_text_run += char_width; 3576 prt_text_run += char_width;
3582 prt_pos_x += char_width; 3577 prt_pos_x += char_width;
3583 3578