mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-24 12:08:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.4895: buffer overflow with invalid command with composing chars

Browse Source 
Problem:    Buffer overflow with invalid command with composing chars.
Solution:   Check that the whole character fits in the buffer.
d88934406c
This commit is contained in:
zeertzjq
2022-06-24 06:25:34 +08:00
parent 764dc7c383
commit 0cf0be302b
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/nvim/ex_docmd.c
View File

@@ -2892,11 +2892,13 @@ static void append_command(char *cmd)
STRCAT(IObuff, ": "); STRCAT(IObuff, ": ");
d = (char *)IObuff + STRLEN(IObuff); d = (char *)IObuff + STRLEN(IObuff);
while (*s != NUL && (char_u *)d - IObuff < IOSIZE - 7) { while (*s != NUL && (char_u *)d - IObuff + 5 < IOSIZE) {
if ((char_u)s[0] == 0xc2 && (char_u)s[1] == 0xa0) { if ((char_u)s[0] == 0xc2 && (char_u)s[1] == 0xa0) {
s += 2; s += 2;
STRCPY(d, "<a0>"); STRCPY(d, "<a0>");
d += 4; d += 4;
} else if ((char_u *)d - IObuff + utfc_ptr2len(s) + 1 >= IOSIZE) {
break;
} else { } else {
mb_copy_char((const char_u **)&s, (char_u **)&d); mb_copy_char((const char_u **)&s, (char_u **)&d);
} }

11
src/nvim/testdir/test_cmdline.vim
View File

@@ -1220,6 +1220,17 @@ func Test_recalling_cmdline()
cunmap <Plug>(save-cmdline) cunmap <Plug>(save-cmdline)
endfunc endfunc
" this was going over the end of IObuff
func Test_report_error_with_composing()
let caught = 'no'
try
exe repeat('0', 987) .. "0\xdd\x80\xdd\x80\xdd\x80\xdd\x80"
catch /E492:/
let caught = 'yes'
endtry
call assert_equal('yes', caught)
endfunc
" Test for expanding 2-letter and 3-letter :substitute command arguments. " Test for expanding 2-letter and 3-letter :substitute command arguments.
" These commands don't accept an argument. " These commands don't accept an argument.
func Test_cmdline_complete_substitute_short() func Test_cmdline_complete_substitute_short()