aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-24 03:44:06 -04:00
Code Activity

patch 8.2.4419: illegal memory access when using 20 highlights

Browse Source 
Problem:    Illegal memory access when using exactly 20 highlights.
Solution:   Add one more item in the array. (Brandon Richardson,
            closes #9800)
This commit is contained in:
Brandon Richardson
2022-02-19 11:45:03 +00:00
committed by Bram Moolenaar
parent 5921aeb574
commit a493b6506b
3 changed files with 22 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/buffer.c
View File

@@ -4170,8 +4170,11 @@ build_stl_str_hl(
{ {
stl_items = ALLOC_MULT(stl_item_T, stl_items_len); stl_items = ALLOC_MULT(stl_item_T, stl_items_len);
stl_groupitem = ALLOC_MULT(int, stl_items_len); stl_groupitem = ALLOC_MULT(int, stl_items_len);
stl_hltab = ALLOC_MULT(stl_hlrec_T, stl_items_len);
stl_tabtab = ALLOC_MULT(stl_hlrec_T, stl_items_len); // Allocate one more, because the last element is used to indicate the
// end of the list.
stl_hltab = ALLOC_MULT(stl_hlrec_T, stl_items_len + 1);
stl_tabtab = ALLOC_MULT(stl_hlrec_T, stl_items_len + 1);
} }
#ifdef FEAT_EVAL #ifdef FEAT_EVAL
@@ -4251,11 +4254,13 @@ build_stl_str_hl(
if (new_groupitem == NULL) if (new_groupitem == NULL)
break; break;
stl_groupitem = new_groupitem; stl_groupitem = new_groupitem;
new_hlrec = vim_realloc(stl_hltab, sizeof(stl_hlrec_T) * new_len); new_hlrec = vim_realloc(stl_hltab,
sizeof(stl_hlrec_T) * (new_len + 1));
if (new_hlrec == NULL) if (new_hlrec == NULL)
break; break;
stl_hltab = new_hlrec; stl_hltab = new_hlrec;
new_hlrec = vim_realloc(stl_tabtab, sizeof(stl_hlrec_T) * new_len); new_hlrec = vim_realloc(stl_tabtab,
sizeof(stl_hlrec_T) * (new_len + 1));
if (new_hlrec == NULL) if (new_hlrec == NULL)
break; break;
stl_tabtab = new_hlrec; stl_tabtab = new_hlrec;

11
src/testdir/test_tabline.vim
View File

@@ -134,6 +134,17 @@ func Test_tabline_empty_group()
set tabline= set tabline=
endfunc endfunc
" When there are exactly 20 tabline format items (the exact size of the
" initial tabline items array), test that we don't write beyond the size
" of the array.
func Test_tabline_20_format_items_no_overrun()
set showtabline=2
let tabline = repeat('%#StatColorHi2#', 20)
let &tabline = tabline
redrawtabline
set showtabline& tabline&
endfunc
" vim: shiftwidth=2 sts=2 expandtab " vim: shiftwidth=2 sts=2 expandtab

2
src/version.c
View File

@@ -750,6 +750,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
4419,
/**/ /**/
4418, 4418,
/**/ /**/