aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-07-26 11:04:33 -04:00
Code

updated for version 7.3.664

Browse Source 
Problem:    Buffer overflow in unescaping text. (Raymond Ko)
Solution:   Limit check for multi-byte character to 4 bytes.
This commit is contained in:
Bram Moolenaar 2012-09-18 18:03:37 +02:00
parent be1e9e9fc1
commit 4fabd7dd4a
2 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/mbyte.c
View File

@ -3793,13 +3793,15 @@ mb_charlen_len(str, len)
mb_unescape(pp) mb_unescape(pp)
char_u **pp; char_u **pp;
{ {
static char_u buf[MB_MAXBYTES + 1]; static char_u buf[6];
int n, m = 0; int n;
int m = 0;
char_u *str = *pp; char_u *str = *pp;
/* Must translate K_SPECIAL KS_SPECIAL KE_FILLER to K_SPECIAL and CSI /* Must translate K_SPECIAL KS_SPECIAL KE_FILLER to K_SPECIAL and CSI
* KS_EXTRA KE_CSI to CSI. */ * KS_EXTRA KE_CSI to CSI.
for (n = 0; str[n] != NUL && m <= MB_MAXBYTES; ++n) * Maximum length of a utf-8 character is 4 bytes. */
for (n = 0; str[n] != NUL && m < 4; ++n)
{ {
if (str[n] == K_SPECIAL if (str[n] == K_SPECIAL
&& str[n + 1] == KS_SPECIAL && str[n + 1] == KS_SPECIAL
@ -3836,6 +3838,10 @@ mb_unescape(pp)
*pp = str + n + 1; *pp = str + n + 1;
return buf; return buf;
} }
/* Bail out quickly for ASCII. */
if (buf[0] < 128)
break;
} }
return NULL; return NULL;
} }

2
src/version.c
View File

@ -719,6 +719,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
664,
/**/ /**/
663, 663,
/**/ /**/