Mercurial > vim
view src/proto/misc1.pro @ 33778:06ad070cda83 v9.0.2109
patch 9.0.2109: [security]: overflow in nv_z_get_count
Commit: https://github.com/vim/vim/commit/58f9befca1fa172068effad7f2ea5a9d6a7b0cca
Author: Christian Brabandt <cb@256bit.org>
Date: Tue Nov 14 21:02:30 2023 +0100
patch 9.0.2109: [security]: overflow in nv_z_get_count
Problem: [security]: overflow in nv_z_get_count
Solution: break out, if count is too large
When getting the count for a normal z command, it may overflow for large
counts given. So verify, that we can safely store the result in a long.
Signed-off-by: Christian Brabandt <cb@256bit.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Thu, 16 Nov 2023 22:15:11 +0100 |
parents | 0503955dcd34 |
children | 370543108ba1 |
line wrap: on
line source
/* misc1.c */ int get_leader_len(char_u *line, char_u **flags, int backward, int include_space); int get_last_leader_offset(char_u *line, char_u **flags); int plines(linenr_T lnum); int plines_win(win_T *wp, linenr_T lnum, int limit_winheight); int plines_nofill(linenr_T lnum); int plines_win_nofill(win_T *wp, linenr_T lnum, int limit_winheight); int plines_win_nofold(win_T *wp, linenr_T lnum); int plines_win_col(win_T *wp, linenr_T lnum, long column); int plines_m_win(win_T *wp, linenr_T first, linenr_T last, int limit_winheight); int gchar_pos(pos_T *pos); int gchar_cursor(void); void pchar_cursor(int c); char_u *skip_to_option_part(char_u *p); void check_status(buf_T *buf); int ask_yesno(char_u *str, int direct); void get_mode(char_u *buf); void f_mode(typval_T *argvars, typval_T *rettv); void f_state(typval_T *argvars, typval_T *rettv); int get_keystroke(void); int get_number(int colon, int *mouse_used); int prompt_for_number(int *mouse_used); void msgmore(long n); void beep_flush(void); void vim_beep(unsigned val); void init_homedir(void); void free_homedir(void); void free_users(void); void init_vimdir(void); char_u *expand_env_save(char_u *src); char_u *expand_env_save_opt(char_u *src, int one); void expand_env(char_u *src, char_u *dst, int dstlen); void expand_env_esc(char_u *srcp, char_u *dst, int dstlen, int esc, int one, char_u *startstr); char_u *vim_getenv(char_u *name, int *mustfree); void vim_unsetenv(char_u *var); void vim_unsetenv_ext(char_u *var); void vim_setenv_ext(char_u *name, char_u *val); void vim_setenv(char_u *name, char_u *val); char_u *get_env_name(expand_T *xp, int idx); char_u *get_users(expand_T *xp, int idx); int match_user(char_u *name); void preserve_exit(void); void line_breakcheck(void); void fast_breakcheck(void); void veryfast_breakcheck(void); char_u *get_cmd_output(char_u *cmd, char_u *infile, int flags, int *ret_len); void f_system(typval_T *argvars, typval_T *rettv); void f_systemlist(typval_T *argvars, typval_T *rettv); int goto_im(void); char_u *get_isolated_shell_name(void); int path_is_url(char_u *p); int path_with_url(char_u *fname); dict_T *get_v_event(save_v_event_T *sve); void restore_v_event(dict_T *v_event, save_v_event_T *sve); void may_trigger_modechanged(void); /* vim: set ft=c : */