mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-28 05:58:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.3601: check for overflow in put count does not work well

Browse Source 
Problem:    Check for overflow in put count does not work well.
Solution:   Improve the overflow check. (Ozaki Kiichi, closes vim/vim#9102)
fa53722367

Add some casts as Nvim uses size_t variables in some places.

We could technically adjust the logic to check for overflow outside of size_t's
range, but it's much easier to just port the patch exactly (also means we can
use the same tests).

v:sizeoflong is N/A, so convert the 64-bit tests to Lua and use the FFI to check
long's size.
This commit is contained in:
Sean Dewar
2022-02-16 22:37:10 +00:00
parent 8170260bb3
commit 41d0e7af20
3 changed files with 112 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
src/nvim/ops.c
View File

@@ -3314,18 +3314,28 @@ void do_put(int regname, yankreg_T *reg, int dir, long count, int flags)
}
}
// insert the new text
// Insert the new text.
// First check for multiplication overflow.
if (yanklen + spaces != 0
&& count > ((INT_MAX - (bd.startspaces + bd.endspaces)) / (yanklen + spaces))) {
emsg(_(e_resulting_text_too_long));
break;
}
totlen = (size_t)(count * (yanklen + spaces)
+ bd.startspaces + bd.endspaces);
int addcount = (int)totlen + lines_appended;
newp = (char_u *)xmalloc(totlen + oldlen + 1);
// copy part up to cursor to new line
ptr = newp;
memmove(ptr, oldp, (size_t)bd.textcol);
ptr += bd.textcol;
// may insert some spaces before the new text
memset(ptr, ' ', (size_t)bd.startspaces);
ptr += bd.startspaces;
// insert the new text
for (long j = 0; j < count; j++) {
memmove(ptr, y_array[i], (size_t)yanklen);
@@ -3339,9 +3349,11 @@ void do_put(int regname, yankreg_T *reg, int dir, long count, int flags)
addcount -= spaces;
}
}
// may insert some spaces after the new text
memset(ptr, ' ', (size_t)bd.endspaces);
ptr += bd.endspaces;
// move the text after the cursor to the end of the line.
int columns = (int)oldlen - bd.textcol - delcount + 1;
assert(columns >= 0);
@@ -3430,15 +3442,18 @@ void do_put(int regname, yankreg_T *reg, int dir, long count, int flags)
}
}
do {
const double multlen = (double)count * (double)yanklen;
totlen = (size_t)(int)(count * yanklen);
if ((double)totlen != multlen) {
emsg(_(e_resulting_text_too_long));
break;
} else if (totlen > 0) {
if (count == 0 || yanklen == 0) {
if (VIsual_active) {
lnum = end_lnum;
}
} else if (count > INT_MAX / yanklen) {
// multiplication overflow
emsg(_(e_resulting_text_too_long));
} else {
totlen = (size_t)(count * yanklen);
do {
oldp = ml_get(lnum);
oldlen = STRLEN(oldp);
if (lnum > start_lnum) {
pos_T pos = {
.lnum = lnum,
@@ -3449,11 +3464,11 @@ void do_put(int regname, yankreg_T *reg, int dir, long count, int flags)
col = MAXCOL;
}
}
if (VIsual_active && col > (int)STRLEN(oldp)) {
if (VIsual_active && col > (colnr_T)oldlen) {
lnum++;
continue;
}
newp = (char_u *)xmalloc((size_t)(STRLEN(oldp) + totlen + 1));
newp = (char_u *)xmalloc(totlen + oldlen + 1);
memmove(newp, oldp, (size_t)col);
ptr = newp + col;
for (i = 0; i < (size_t)count; i++) {
@@ -3475,14 +3490,14 @@ void do_put(int regname, yankreg_T *reg, int dir, long count, int flags)
changed_bytes(lnum, col);
extmark_splice_cols(curbuf, (int)lnum-1, col,
0, (int)totlen, kExtmarkUndo);
}
if (VIsual_active) {
lnum++;
}
} while (VIsual_active && lnum <= end_lnum);
if (VIsual_active) {
lnum++;
}
} while (VIsual_active && lnum <= end_lnum);
if (VIsual_active) { // reset lnum to the last visual line
lnum--;
if (VIsual_active) { // reset lnum to the last visual line
lnum--;
}
}
// put '] at the first byte of the last character