view runtime/autoload/dist/man.vim @ 33864:6e4c686b6b5b v9.0.2142

patch 9.0.2142: [security]: stack-buffer-overflow in option callback functions Commit: https://github.com/vim/vim/commit/b39b240c386a5a29241415541f1c99e2e6b8ce47 Author: Christian Brabandt <cb@256bit.org> Date: Wed Nov 29 11:34:05 2023 +0100 patch 9.0.2142: [security]: stack-buffer-overflow in option callback functions Problem: [security]: stack-buffer-overflow in option callback functions Solution: pass size of errbuf down the call stack, use snprintf() instead of sprintf() We pass the error buffer down to the option callback functions, but in some parts of the code, we simply use sprintf(buf) to write into the error buffer, which can overflow. So let's pass down the length of the error buffer and use sprintf(buf, size) instead. Reported by @henices, thanks! Signed-off-by: Christian Brabandt <cb@256bit.org>
author Christian Brabandt <cb@256bit.org>
date Sun, 10 Dec 2023 15:16:04 +0100
parents 058fa5df3376
children 86031416a201
line wrap: on
line source

" Vim filetype plugin autoload file
" Language:	man
" Maintainer:	Jason Franklin <jason@oneway.dev>
" Maintainer:	SungHyun Nam <goweol@gmail.com>
" Autoload Split: Bram Moolenaar
" Last Change: 	2023 Jun 28

let s:cpo_save = &cpo
set cpo-=C

let s:man_tag_depth = 0

let s:man_sect_arg = ""
let s:man_find_arg = "-w"
try
  if !has("win32") && $OSTYPE !~ 'cygwin\|linux' && system('uname -s') =~ "SunOS" && system('uname -r') =~ "^5"
    let s:man_sect_arg = "-s"
    let s:man_find_arg = "-l"
  endif
catch /E145:/
  " Ignore the error in restricted mode
endtry

func s:ParseIntoPageAndSection()
  " Accommodate a reference that terminates in a hyphen.
  "
  " See init_charset_table() at
  " https://git.savannah.gnu.org/cgit/groff.git/tree/src/roff/troff/input.cpp?h=1.22.4#n6794
  "
  " See can_break_after() at
  " https://git.savannah.gnu.org/cgit/groff.git/tree/src/roff/troff/charinfo.h?h=1.22.4#n140
  "
  " Assumptions and limitations:
  " 1) Manual-page references (in consequence of command-related filenames)
  "    do not contain non-ASCII HYPHENs (0x2010), any terminating HYPHEN
  "    must have been introduced to mark division of a word at the end of
  "    a line and can be discarded; whereas similar references may contain
  "    ASCII HYPHEN-MINUSes (0x002d) and any terminating HYPHEN-MINUS forms
  "    a compound word in addition to marking word division.
  " 2) Well-formed manual-page references always have a section suffix, e.g.
  "    "git-commit(1)", therefore suspended hyphenated compounds are not
  "    determined, e.g.     [V] (With cursor at _git-merge-_ below...)
  "    ".................... git-merge- and git-merge-base. (See git-cherry-
  "    pick(1) and git-cherry(1).)" (... look up "git-merge-pick(1)".)
  "
  " Note that EM DASH (0x2014), a third stooge from init_charset_table(),
  " neither connects nor divides parts of a word.
  let str = expand("<cWORD>")

  if str =~ '\%u2010$'	" HYPHEN (-1).
    let str = strpart(str, 0, strridx(str, "\u2010"))

    " Append the leftmost WORD (or an empty string) from the line below.
    let str .= get(split(get(getbufline(bufnr('%'), line('.') + 1), 0, '')), 0, '')
  elseif str =~ '-$'	" HYPHEN-MINUS.
    " Append the leftmost WORD (or an empty string) from the line below.
    let str .= get(split(get(getbufline(bufnr('%'), line('.') + 1), 0, '')), 0, '')
  endif

  " According to man(1), section name formats vary (MANSECT):
  " 1 n l 8 3 2 3posix 3pm 3perl 3am 5 4 9 6 7
  let parts = matchlist(str, '\(\k\+\)(\(\k\+\))')
  return (len(parts) > 2)
	  \ ? {'page': parts[1], 'section': parts[2]}
	  \ : {'page': matchstr(str, '\k\+'), 'section': ''}
endfunc

func dist#man#PreGetPage(cnt)
  if a:cnt == 0
    let what = s:ParseIntoPageAndSection()
    let sect = what.section
    let page = what.page
  else
    let what = s:ParseIntoPageAndSection()
    let sect = a:cnt
    let page = what.page
  endif

  call dist#man#GetPage('', sect, page)
endfunc

func s:GetCmdArg(sect, page)
  if empty(a:sect)
    return shellescape(a:page)
  endif

  return s:man_sect_arg . ' ' . shellescape(a:sect) . ' ' . shellescape(a:page)
endfunc

func s:FindPage(sect, page)
  let l:cmd = printf('man %s %s', s:man_find_arg, s:GetCmdArg(a:sect, a:page))
  call system(l:cmd)

  if v:shell_error
    return 0
  endif

  return 1
endfunc

func dist#man#GetPage(cmdmods, ...)
  if a:0 >= 2
    let sect = a:1
    let page = a:2
  elseif a:0 >= 1
    let sect = ""
    let page = a:1
  else
    return
  endif

  " To support:	    nmap K :Man <cWORD><CR>
  if page ==? '<cword>'
    let what = s:ParseIntoPageAndSection()
    let sect = what.section
    let page = what.page
  endif

  if !exists('g:ft_man_no_sect_fallback') || (g:ft_man_no_sect_fallback == 0)
    if sect != "" && s:FindPage(sect, page) == 0
      let sect = ""
    endif
  endif
  if s:FindPage(sect, page) == 0
    let msg = 'man.vim: no manual entry for "' . page . '"'
    if !empty(sect)
      let msg .= ' in section ' . sect
    endif
    echomsg msg
    return
  endif
  exec "let s:man_tag_buf_".s:man_tag_depth." = ".bufnr("%")
  exec "let s:man_tag_lin_".s:man_tag_depth." = ".line(".")
  exec "let s:man_tag_col_".s:man_tag_depth." = ".col(".")
  let s:man_tag_depth = s:man_tag_depth + 1

  let open_cmd = 'edit'

  " Use an existing "man" window if it exists, otherwise open a new one.
  if &filetype != "man"
    let thiswin = winnr()
    exe "norm! \<C-W>b"
    if winnr() > 1
      exe "norm! " . thiswin . "\<C-W>w"
      while 1
	if &filetype == "man"
	  break
	endif
	exe "norm! \<C-W>w"
	if thiswin == winnr()
	  break
	endif
      endwhile
    endif
    if &filetype != "man"
      if exists("g:ft_man_open_mode")
        if g:ft_man_open_mode == 'vert'
	  let open_cmd = 'vsplit'
        elseif g:ft_man_open_mode == 'tab'
	  let open_cmd = 'tabedit'
        else
	  let open_cmd = 'split'
        endif
      else
	let open_cmd = a:cmdmods . ' split'
      endif
    endif
  endif

  silent execute open_cmd . " $HOME/" . page . '.' . sect . '~'

  " Avoid warning for editing the dummy file twice
  setl buftype=nofile noswapfile

  setl fdc=0 ma nofen nonu nornu
  %delete _
  let unsetwidth = 0
  if empty($MANWIDTH)
    let $MANWIDTH = winwidth(0)
    let unsetwidth = 1
  endif

  " Ensure Vim is not recursively invoked (man-db does this) when doing ctrl-[
  " on a man page reference by unsetting MANPAGER.
  " Some versions of env(1) do not support the '-u' option, and in such case
  " we set MANPAGER=cat.
  if !exists('s:env_has_u')
    call system('env -u x true')
    let s:env_has_u = (v:shell_error == 0)
  endif
  let env_cmd = s:env_has_u ? 'env -u MANPAGER' : 'env MANPAGER=cat'
  let env_cmd .= ' GROFF_NO_SGR=1'
  let man_cmd = env_cmd . ' man ' . s:GetCmdArg(sect, page)

  silent exec "r !" . man_cmd

  " Emulate piping the buffer through the "col -b" command.
  " Ref: https://github.com/vim/vim/issues/12301
  exe 'silent! keepjumps keeppatterns %s/\v(.)\b\ze\1?//e' .. (&gdefault ? '' : 'g')

  if unsetwidth
    let $MANWIDTH = ''
  endif
  " Remove blank lines from top and bottom.
  while line('$') > 1 && getline(1) =~ '^\s*$'
    1delete _
  endwhile
  while line('$') > 1 && getline('$') =~ '^\s*$'
    $delete _
  endwhile
  1
  setl ft=man nomod
  setl bufhidden=hide
  setl nobuflisted
  setl noma
endfunc

func dist#man#PopPage()
  if s:man_tag_depth > 0
    let s:man_tag_depth = s:man_tag_depth - 1
    exec "let s:man_tag_buf=s:man_tag_buf_".s:man_tag_depth
    exec "let s:man_tag_lin=s:man_tag_lin_".s:man_tag_depth
    exec "let s:man_tag_col=s:man_tag_col_".s:man_tag_depth

    exec s:man_tag_buf."b"
    call cursor(s:man_tag_lin, s:man_tag_col)

    exec "unlet s:man_tag_buf_".s:man_tag_depth
    exec "unlet s:man_tag_lin_".s:man_tag_depth
    exec "unlet s:man_tag_col_".s:man_tag_depth
    unlet s:man_tag_buf s:man_tag_lin s:man_tag_col
  endif
endfunc

let &cpo = s:cpo_save
unlet s:cpo_save

" vim: set sw=2 ts=8 noet: