Mercurial > vim

comparison src/getchar.c @ 9898:bff8a09016a5 v7.4.2223

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
commit https://github.com/vim/vim/commit/d3c907b5d2b352482b580a0cf687cbbea4c19ea1 Author: Bram Moolenaar <Bram@vim.org> Date: Wed Aug 17 21:32:09 2016 +0200 patch 7.4.2223 Problem: Buffer overflow when using latin1 character with feedkeys(). Solution: Check for an illegal character. Add a test.
author Christian Brabandt <cb@256bit.org>
date Wed, 17 Aug 2016 21:45:07 +0200
parents 7b39615c0db1
children b222552cf0c4
comparison
equal deleted inserted replaced
9897:9d1354639a36 9898:bff8a09016a5
4656 char_u *p) 4656 char_u *p)
4657 { 4657 {
4658 char_u *res; 4658 char_u *res;
4659 char_u *s, *d; 4659 char_u *s, *d;
4660 4660
4661 /* Need a buffer to hold up to three times as much. */ 4661 /* Need a buffer to hold up to three times as much. Four in case of an
4662 res = alloc((unsigned)(STRLEN(p) * 3) + 1); 4662 * illegal utf-8 byte:
4663 * 0xc0 -> 0xc3 0x80 -> 0xc3 K_SPECIAL KS_SPECIAL KE_FILLER */
4664 res = alloc((unsigned)(STRLEN(p) *
4665 #ifdef FEAT_MBYTE
4666 4
4667 #else
4668 3
4669 #endif
4670 ) + 1);
4663 if (res != NULL) 4671 if (res != NULL)
4664 { 4672 {
4665 d = res; 4673 d = res;
4666 for (s = p; *s != NUL; ) 4674 for (s = p; *s != NUL; )
4667 { 4675 {
4672 *d++ = *s++; 4680 *d++ = *s++;
4673 *d++ = *s++; 4681 *d++ = *s++;
4674 } 4682 }
4675 else 4683 else
4676 { 4684 {
4677 #ifdef FEAT_MBYTE
4678 int len = mb_char2len(PTR2CHAR(s));
4679 int len2 = mb_ptr2len(s);
4680 #endif
4681 /* Add character, possibly multi-byte to destination, escaping 4685 /* Add character, possibly multi-byte to destination, escaping
4682 * CSI and K_SPECIAL. */ 4686 * CSI and K_SPECIAL. Be careful, it can be an illegal byte! */
4683 d = add_char2buf(PTR2CHAR(s), d); 4687 d = add_char2buf(PTR2CHAR(s), d);
4684 #ifdef FEAT_MBYTE 4688 s += MB_CPTR2LEN(s);
4685 while (len < len2)
4686 {
4687 /* add following combining char */
4688 d = add_char2buf(PTR2CHAR(s + len), d);
4689 len += mb_char2len(PTR2CHAR(s + len));
4690 }
4691 #endif
4692 mb_ptr_adv(s);
4693 } 4689 }
4694 } 4690 }
4695 *d = NUL; 4691 *d = NUL;
4696 } 4692 }
4697 return res; 4693 return res;