mirror of
https://github.com/neovim/neovim.git
synced 2025-11-11 21:08:53 +00:00
input: Fix conversion error in convert_input()
The `rbuffer_consumed` was being passed a consumed count from another buffer, causing integer overflow in `rbuffer_relocate`. Fixes #1343
This commit is contained in:
@@ -1,3 +1,4 @@
|
|||||||
|
#include <assert.h>
|
||||||
#include <string.h>
|
#include <string.h>
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
#include <stdbool.h>
|
#include <stdbool.h>
|
||||||
@@ -237,18 +238,23 @@ static void convert_input(void)
|
|||||||
|
|
||||||
if (convert) {
|
if (convert) {
|
||||||
// Perform input conversion according to `input_conv`
|
// Perform input conversion according to `input_conv`
|
||||||
size_t unconverted_length;
|
size_t unconverted_length = 0;
|
||||||
data = (char *)string_convert_ext(&input_conv,
|
data = (char *)string_convert_ext(&input_conv,
|
||||||
(uint8_t *)data,
|
(uint8_t *)data,
|
||||||
(int *)&converted_length,
|
(int *)&converted_length,
|
||||||
(int *)&unconverted_length);
|
(int *)&unconverted_length);
|
||||||
data_length = rbuffer_pending(read_buffer) - unconverted_length;
|
data_length -= unconverted_length;
|
||||||
}
|
}
|
||||||
|
|
||||||
// Write processed data to input buffer
|
// The conversion code will be gone eventually, for now assume `input_buffer`
|
||||||
size_t consumed = rbuffer_write(input_buffer, data, data_length);
|
// always has space for the converted data(it's many times the size of
|
||||||
|
// `read_buffer`, so it's hard to imagine a scenario where the converted data
|
||||||
|
// doesn't fit)
|
||||||
|
assert(converted_length <= rbuffer_available(input_buffer));
|
||||||
|
// Write processed data to input buffer.
|
||||||
|
(void)rbuffer_write(input_buffer, data, converted_length);
|
||||||
// Adjust raw buffer pointers
|
// Adjust raw buffer pointers
|
||||||
rbuffer_consumed(read_buffer, consumed);
|
rbuffer_consumed(read_buffer, data_length);
|
||||||
|
|
||||||
if (convert) {
|
if (convert) {
|
||||||
// data points to memory allocated by `string_convert_ext`, free it.
|
// data points to memory allocated by `string_convert_ext`, free it.
|
||||||
|
|||||||
@@ -396,6 +396,7 @@ static void close_cb(uv_handle_t *handle)
|
|||||||
|
|
||||||
static void rbuffer_relocate(RBuffer *rbuffer)
|
static void rbuffer_relocate(RBuffer *rbuffer)
|
||||||
{
|
{
|
||||||
|
assert(rbuffer->rpos <= rbuffer->wpos);
|
||||||
// Move data ...
|
// Move data ...
|
||||||
memmove(
|
memmove(
|
||||||
rbuffer->data, // ...to the beginning of the buffer(rpos 0)
|
rbuffer->data, // ...to the beginning of the buffer(rpos 0)
|
||||||
|
|||||||
Reference in New Issue
Block a user