Mercurial > vim

view src/proto/clipboard.pro @ 33864:6e4c686b6b5b v9.0.2142

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 9.0.2142: [security]: stack-buffer-overflow in option callback functions Commit: https://github.com/vim/vim/commit/b39b240c386a5a29241415541f1c99e2e6b8ce47 Author: Christian Brabandt <cb@256bit.org> Date: Wed Nov 29 11:34:05 2023 +0100 patch 9.0.2142: [security]: stack-buffer-overflow in option callback functions Problem: [security]: stack-buffer-overflow in option callback functions Solution: pass size of errbuf down the call stack, use snprintf() instead of sprintf() We pass the error buffer down to the option callback functions, but in some parts of the code, we simply use sprintf(buf) to write into the error buffer, which can overflow. So let's pass down the length of the error buffer and use sprintf(buf, size) instead. Reported by @henices, thanks! Signed-off-by: Christian Brabandt <cb@256bit.org>
author Christian Brabandt <cb@256bit.org>
date Sun, 10 Dec 2023 15:16:04 +0100
parents ca6bc7c04163
children
line wrap: on
line source

/* clipboard.c */
void clip_init(int can_use);
void clip_update_selection(Clipboard_T *clip);
void clip_own_selection(Clipboard_T *cbd);
void clip_lose_selection(Clipboard_T *cbd);
void start_global_changes(void);
void end_global_changes(void);
void clip_auto_select(void);
int clip_isautosel_star(void);
int clip_isautosel_plus(void);
void clip_modeless(int button, int is_click, int is_drag);
void clip_start_selection(int col, int row, int repeated_click);
void clip_process_selection(int button, int col, int row, int_u repeated_click);
void clip_may_redraw_selection(int row, int col, int len);
void clip_clear_selection(Clipboard_T *cbd);
void clip_may_clear_selection(int row1, int row2);
void clip_scroll_selection(int rows);
void clip_copy_modeless_selection(int both);
void clip_gen_set_selection(Clipboard_T *cbd);
int clip_gen_owner_exists(Clipboard_T *cbd);
char *did_set_clipboard(optset_T *args);
void open_app_context(void);
void x11_setup_atoms(Display *dpy);
void x11_setup_selection(Widget w);
void clip_x11_request_selection(Widget myShell, Display *dpy, Clipboard_T *cbd);
void clip_x11_lose_selection(Widget myShell, Clipboard_T *cbd);
int clip_x11_own_selection(Widget myShell, Clipboard_T *cbd);
void clip_x11_set_selection(Clipboard_T *cbd);
void yank_cut_buffer0(Display *dpy, Clipboard_T *cbd);
void x11_export_final_selection(void);
void clip_free_selection(Clipboard_T *cbd);
void clip_get_selection(Clipboard_T *cbd);
void clip_yank_selection(int type, char_u *str, long len, Clipboard_T *cbd);
int clip_convert_selection(char_u **str, long_u *len, Clipboard_T *cbd);
int may_get_selection(int regname);
void may_set_selection(void);
void adjust_clip_reg(int *rp);
/* vim: set ft=c : */