Mercurial > vim
view .hgignore @ 33784:872c07d5befe v9.0.2112
patch 9.0.2112: [security]: overflow in shift_line
Commit: https://github.com/vim/vim/commit/6bf131888a3d1de62bbfa8a7ea03c0ddccfd496e
Author: Christian Brabandt <cb@256bit.org>
Date: Tue Nov 14 22:42:59 2023 +0100
patch 9.0.2112: [security]: overflow in shift_line
Problem: [security]: overflow in shift_line
Solution: allow a max indent of INT_MAX
[security]: overflow in shift_line
When shifting lines in operator pending mode and using a very large
value, we may overflow the size of integer. Fix this by using a long
variable, testing if the result would be larger than INT_MAX and if so,
indent by INT_MAX value.
Special case: We cannot use long here, since on 32bit architectures (or
on Windows?), it typically cannot take larger values than a plain int,
so we have to use long long count, decide whether the resulting
multiplication of the shiftwidth value * amount is larger than INT_MAX
and if so, we will store INT_MAX as possible larges value in the long
long count variable.
Then we can safely cast it back to int when calling the functions to set
the indent (set_indent() or change_indent()). So this should be safe.
Add a test that when using a huge value in operator pending mode for
shifting, we will shift by INT_MAX
closes: #13535
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Thu, 16 Nov 2023 22:15:15 +0100 |
| parents | 7aeaf20e2ba5 |
| children | 6e66a52748d0 |
line wrap: on
line source
syntax: glob # Unixen: object and executable files. *.o src/vim src/xxd/xxd src/auto/if_perl.c src/auto/gui_gtk_gresources.c src/auto/gui_gtk_gresources.h src/auto/os_haiku.rdef src/objects/.dirstamp src/objects src/types.vim # We do need src/auto/configure. src/auto/config.cache src/auto/config.h src/auto/config.log src/auto/config.mk src/auto/config.status src/auto/osdef.h src/auto/link.log src/auto/link.sed src/auto/pathdef.c # Windows *.exe *.idb *.exp *.map *.obj *.pdb *.ilk *.sln *.suo *.res *.RES vim*.dll vim*.lib src/dobj*/pathdef.c src/gobj*/pathdef.c src/obj*/pathdef.c src/Obj*/pathdef.c gvimext.dll gvimext.lib gvim.lib runtime/doc/uganda.nsis.txt nsis/icons/* /vim90/ .vscode/ # NetBeans nbproject/* # Mac OSX src/xxd/xxd.dSYM .DS_Store # All platforms *.rej *.orig *.mo *.swp *~ *.pyc *.log src/po/vim.pot src/tags /tags /GPATH /GTAGS /GRTAGS nsis/tags # Generated by "make test" src/po/*.ck src/po/*.desktop src/testdir/mbyte.vim src/testdir/mzscheme.vim src/testdir/lua.vim src/testdir/small.vim src/testdir/tiny.vim src/testdir/test*.out src/testdir/test*.failed src/testdir/test.log src/testdir/dostmp/* src/testdir/messages src/testdir/viminfo src/testdir/opt_test.vim src/testdir/failed src/testdir/starttime runtime/indent/testdir/*.out runtime/indent/testdir/*.fail src/memfile_test src/json_test src/message_test src/kword_test # Generated by "make install" runtime/doc/doctags # Generated by "make shadow". The directory names could be anything but we # restrict them to shadow (the default) or shadow-* src/shadow src/shadow-* src/runtime src/pixmaps # other files possibly created by tools src/cscope.out # Linter/language server files /.cache/clangd/ /.ccls-cache/ /compile_commands.json