Mercurial > vim
changeset 27434:c1702fd7e716 v8.2.4245
patch 8.2.4245: ":retab 0" may cause illegal memory access
Commit: https://github.com/vim/vim/commit/652dee448618589de5528a9e9a36995803f5557a
Author: Bram Moolenaar <Bram@vim.org>
Date: Fri Jan 28 20:47:49 2022 +0000
patch 8.2.4245: ":retab 0" may cause illegal memory access
Problem: ":retab 0" may cause illegal memory access.
Solution: Limit the value of 'tabstop' to 10000.
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Fri, 28 Jan 2022 22:00:05 +0100 |
| parents | 5d1b4d8eea05 |
| children | 38c472afefd4 |
| files | src/indent.c src/option.c src/testdir/test_options.vim src/version.c src/vim.h |
| diffstat | 5 files changed, 17 insertions(+), 9 deletions(-) [+] |
line wrap: on
line diff
--- a/src/indent.c +++ b/src/indent.c @@ -71,7 +71,7 @@ tabstop_set(char_u *var, int **array) int n = atoi((char *)cp); // Catch negative values, overflow and ridiculous big values. - if (n < 0 || n > 9999) + if (n < 0 || n > TABSTOP_MAX) { semsg(_(e_invalid_argument_str), cp); vim_free(*array); @@ -1649,7 +1649,7 @@ ex_retab(exarg_T *eap) emsg(_(e_argument_must_be_positive)); return; } - if (new_ts < 0 || new_ts > 9999) + if (new_ts < 0 || new_ts > TABSTOP_MAX) { semsg(_(e_invalid_argument_str), eap->arg); return;
--- a/src/option.c +++ b/src/option.c @@ -3752,6 +3752,11 @@ set_num_option( errmsg = e_argument_must_be_positive; curbuf->b_p_ts = 8; } + else if (curbuf->b_p_ts > TABSTOP_MAX) + { + errmsg = e_invalid_argument; + curbuf->b_p_ts = 8; + } if (p_tm < 0) { errmsg = e_argument_must_be_positive; @@ -5983,7 +5988,7 @@ buf_copy_options(buf_T *buf, int flags) if (p_vsts && p_vsts != empty_option) (void)tabstop_set(p_vsts, &buf->b_p_vsts_array); else - buf->b_p_vsts_array = 0; + buf->b_p_vsts_array = NULL; buf->b_p_vsts_nopaste = p_vsts_nopaste ? vim_strsave(p_vsts_nopaste) : NULL; #endif @@ -6803,9 +6808,7 @@ paste_option_changed(void) if (buf->b_p_vsts) free_string_option(buf->b_p_vsts); buf->b_p_vsts = empty_option; - if (buf->b_p_vsts_array) - vim_free(buf->b_p_vsts_array); - buf->b_p_vsts_array = 0; + VIM_CLEAR(buf->b_p_vsts_array); #endif } @@ -6851,12 +6854,11 @@ paste_option_changed(void) free_string_option(buf->b_p_vsts); buf->b_p_vsts = buf->b_p_vsts_nopaste ? vim_strsave(buf->b_p_vsts_nopaste) : empty_option; - if (buf->b_p_vsts_array) - vim_free(buf->b_p_vsts_array); + vim_free(buf->b_p_vsts_array); if (buf->b_p_vsts && buf->b_p_vsts != empty_option) (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array); else - buf->b_p_vsts_array = 0; + buf->b_p_vsts_array = NULL; #endif }
--- a/src/testdir/test_options.vim +++ b/src/testdir/test_options.vim @@ -368,6 +368,8 @@ func Test_set_errors() call assert_fails('set shiftwidth=-1', 'E487:') call assert_fails('set sidescroll=-1', 'E487:') call assert_fails('set tabstop=-1', 'E487:') + call assert_fails('set tabstop=10000', 'E474:') + call assert_fails('set tabstop=5500000000', 'E474:') call assert_fails('set textwidth=-1', 'E487:') call assert_fails('set timeoutlen=-1', 'E487:') call assert_fails('set updatecount=-1', 'E487:')