aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-25 03:54:15 -04:00
Code Activity

patch 9.0.1458: buffer overflow when expanding long file name

Browse Source 
Problem:    Buffer overflow when expanding long file name.
Solution:   Use a larger buffer and avoid overflowing it. (Yee Cheng Chin,
            closes #12201)
This commit is contained in:
Yee Cheng Chin
2023-04-16 20:13:12 +01:00
committed by Bram Moolenaar
parent ceff9cd1bb
commit a77670726e
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/filepath.c
View File

@@ -938,9 +938,9 @@ f_filewritable(typval_T *argvars, typval_T *rettv)
static void static void
findfilendir( findfilendir(
typval_T *argvars UNUSED, typval_T *argvars,
typval_T *rettv, typval_T *rettv,
int find_what UNUSED) int find_what)
{ {
char_u *fname; char_u *fname;
char_u *fresult = NULL; char_u *fresult = NULL;
@@ -3685,7 +3685,6 @@ unix_expandpath(
int didstar) // expanded "**" once already int didstar) // expanded "**" once already
{ {
char_u *buf; char_u *buf;
size_t buflen;
char_u *path_end; char_u *path_end;
char_u *p, *s, *e; char_u *p, *s, *e;
int start_len = gap->ga_len; int start_len = gap->ga_len;
@@ -3708,8 +3707,8 @@ unix_expandpath(
return 0; return 0;
} }
// make room for file name // make room for file name (a bit too much to stay on the safe side)
buflen = STRLEN(path) + BASENAMELEN + 5; size_t buflen = STRLEN(path) + MAXPATHL;
buf = alloc(buflen); buf = alloc(buflen);
if (buf == NULL) if (buf == NULL)
return 0; return 0;
@@ -3828,7 +3827,7 @@ unix_expandpath(
|| ((flags & EW_NOTWILD) || ((flags & EW_NOTWILD)
&& fnamencmp(path + (s - buf), dp->d_name, e - s) == 0))) && fnamencmp(path + (s - buf), dp->d_name, e - s) == 0)))
{ {
STRCPY(s, dp->d_name); vim_strncpy(s, (char_u *)dp->d_name, buflen - (s - buf) - 1);
len = STRLEN(buf); len = STRLEN(buf);
if (starstar && stardepth < 100) if (starstar && stardepth < 100)

2
src/version.c
View File

@@ -695,6 +695,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
1458,
/**/ /**/
1457, 1457,
/**/ /**/