Mercurial > vim
changeset 10646:8cff35d5f5dc v8.0.0213
patch 8.0.0213: Netbeans specialKeys command does not check argument length
commit https://github.com/vim/vim/commit/ca24e2cfcfd3f064ea1674886e3dcaa8254ad8d7
Author: Bram Moolenaar <Bram@vim.org>
Date: Sun Jan 22 15:19:22 2017 +0100
patch 8.0.0213: Netbeans specialKeys command does not check argument length
Problem: The Netbeans "specialKeys" command does not check if the argument
fits in the buffer. (Coverity)
Solution: Add a length check.
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 22 Jan 2017 15:30:04 +0100 |
| parents | b3aee1f74787 |
| children | 9588a81b6d2c |
| files | src/netbeans.c src/version.c |
| diffstat | 2 files changed, 11 insertions(+), 5 deletions(-) [+] |
line wrap: on
line diff
--- a/src/netbeans.c +++ b/src/netbeans.c @@ -2332,7 +2332,8 @@ special_keys(char_u *args) char *save_str = nb_unquote(args, NULL); char *tok = strtok(save_str, " "); char *sep; - char keybuf[64]; +#define KEYBUFLEN 64 + char keybuf[KEYBUFLEN]; char cmdbuf[256]; while (tok != NULL) @@ -2359,10 +2360,13 @@ special_keys(char_u *args) tok++; } - strcpy(&keybuf[i], tok); - vim_snprintf(cmdbuf, sizeof(cmdbuf), - "<silent><%s> :nbkey %s<CR>", keybuf, keybuf); - do_map(0, (char_u *)cmdbuf, NORMAL, FALSE); + if (strlen(tok) + i < KEYBUFLEN) + { + strcpy(&keybuf[i], tok); + vim_snprintf(cmdbuf, sizeof(cmdbuf), + "<silent><%s> :nbkey %s<CR>", keybuf, keybuf); + do_map(0, (char_u *)cmdbuf, NORMAL, FALSE); + } tok = strtok(NULL, " "); } vim_free(save_str);