Mercurial > vim
comparison src/undo.c @ 10976:f97a72ad8ffa v8.0.0377
patch 8.0.0377: possible overflow when reading corrupted undo file
commit https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c
Author: Bram Moolenaar <Bram@vim.org>
Date: Sun Feb 26 18:11:36 2017 +0100
patch 8.0.0377: possible overflow when reading corrupted undo file
Problem: Possible overflow when reading corrupted undo file.
Solution: Check if allocated size is not too big. (King)
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 26 Feb 2017 18:15:04 +0100 |
| parents | cbf17371627c |
| children | f3d64d9e5d76 |
comparison
equal
deleted
inserted
replaced
| 10975:67a025a62042 | 10976:f97a72ad8ffa |
|---|---|
| 1785 long version, str_len; | 1785 long version, str_len; |
| 1786 char_u *line_ptr = NULL; | 1786 char_u *line_ptr = NULL; |
| 1787 linenr_T line_lnum; | 1787 linenr_T line_lnum; |
| 1788 colnr_T line_colnr; | 1788 colnr_T line_colnr; |
| 1789 linenr_T line_count; | 1789 linenr_T line_count; |
| 1790 int num_head = 0; | 1790 long num_head = 0; |
| 1791 long old_header_seq, new_header_seq, cur_header_seq; | 1791 long old_header_seq, new_header_seq, cur_header_seq; |
| 1792 long seq_last, seq_cur; | 1792 long seq_last, seq_cur; |
| 1793 long last_save_nr = 0; | 1793 long last_save_nr = 0; |
| 1794 short old_idx = -1, new_idx = -1, cur_idx = -1; | 1794 short old_idx = -1, new_idx = -1, cur_idx = -1; |
| 1795 long num_read_uhps = 0; | 1795 long num_read_uhps = 0; |
| 1972 * until we insert them into curbuf. The table remains sorted by the | 1972 * until we insert them into curbuf. The table remains sorted by the |
| 1973 * sequence numbers of the headers. | 1973 * sequence numbers of the headers. |
| 1974 * When there are no headers uhp_table is NULL. */ | 1974 * When there are no headers uhp_table is NULL. */ |
| 1975 if (num_head > 0) | 1975 if (num_head > 0) |
| 1976 { | 1976 { |
| 1977 uhp_table = (u_header_T **)U_ALLOC_LINE( | 1977 if (num_head < LONG_MAX / (long)sizeof(u_header_T *)) |
| 1978 uhp_table = (u_header_T **)U_ALLOC_LINE( | |
| 1978 num_head * sizeof(u_header_T *)); | 1979 num_head * sizeof(u_header_T *)); |
| 1979 if (uhp_table == NULL) | 1980 if (uhp_table == NULL) |
| 1980 goto error; | 1981 goto error; |
| 1981 } | 1982 } |
| 1982 | 1983 |