Mercurial > vim
changeset 27786:fa675efa1e75 v8.2.4419
patch 8.2.4419: illegal memory access when using 20 highlights
Commit: https://github.com/vim/vim/commit/a493b6506b67887a1cc2d1c00a896598c3b2d445
Author: Brandon Richardson <brandon.richardson@siemens.com>
Date: Sat Feb 19 11:45:03 2022 +0000
patch 8.2.4419: illegal memory access when using 20 highlights
Problem: Illegal memory access when using exactly 20 highlights.
Solution: Add one more item in the array. (Brandon Richardson,
closes #9800)
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Sat, 19 Feb 2022 13:00:03 +0100 |
| parents | 309353f3efd3 |
| children | f21b1b2a903f |
| files | src/buffer.c src/testdir/test_tabline.vim src/version.c |
| diffstat | 3 files changed, 22 insertions(+), 4 deletions(-) [+] |
line wrap: on
line diff
--- a/src/buffer.c +++ b/src/buffer.c @@ -4170,8 +4170,11 @@ build_stl_str_hl( { stl_items = ALLOC_MULT(stl_item_T, stl_items_len); stl_groupitem = ALLOC_MULT(int, stl_items_len); - stl_hltab = ALLOC_MULT(stl_hlrec_T, stl_items_len); - stl_tabtab = ALLOC_MULT(stl_hlrec_T, stl_items_len); + + // Allocate one more, because the last element is used to indicate the + // end of the list. + stl_hltab = ALLOC_MULT(stl_hlrec_T, stl_items_len + 1); + stl_tabtab = ALLOC_MULT(stl_hlrec_T, stl_items_len + 1); } #ifdef FEAT_EVAL @@ -4251,11 +4254,13 @@ build_stl_str_hl( if (new_groupitem == NULL) break; stl_groupitem = new_groupitem; - new_hlrec = vim_realloc(stl_hltab, sizeof(stl_hlrec_T) * new_len); + new_hlrec = vim_realloc(stl_hltab, + sizeof(stl_hlrec_T) * (new_len + 1)); if (new_hlrec == NULL) break; stl_hltab = new_hlrec; - new_hlrec = vim_realloc(stl_tabtab, sizeof(stl_hlrec_T) * new_len); + new_hlrec = vim_realloc(stl_tabtab, + sizeof(stl_hlrec_T) * (new_len + 1)); if (new_hlrec == NULL) break; stl_tabtab = new_hlrec;
--- a/src/testdir/test_tabline.vim +++ b/src/testdir/test_tabline.vim @@ -134,6 +134,17 @@ func Test_tabline_empty_group() set tabline= endfunc +" When there are exactly 20 tabline format items (the exact size of the +" initial tabline items array), test that we don't write beyond the size +" of the array. +func Test_tabline_20_format_items_no_overrun() + set showtabline=2 + let tabline = repeat('%#StatColorHi2#', 20) + let &tabline = tabline + redrawtabline + + set showtabline& tabline& +endfunc " vim: shiftwidth=2 sts=2 expandtab