0
0
mirror of https://github.com/vim/vim.git synced 2025-07-26 11:04:33 -04:00

patch 8.2.3855: illegal memory access when displaying a blob

Problem:    Illegal memory access when displaying a blob.
Solution:   Append a NUL at the end. (Yegappan Lakshmanan, closes #9372)
This commit is contained in:
Yegappan Lakshmanan 2021-12-19 19:19:31 +00:00 committed by Bram Moolenaar
parent 86b3ab4fa0
commit bc404bfb32
5 changed files with 14 additions and 4 deletions

View File

@ -240,6 +240,7 @@ blob2string(blob_T *blob, char_u **tofree, char_u *numbuf)
vim_snprintf((char *)numbuf, NUMBUFLEN, "%02X", (int)blob_get(blob, i)); vim_snprintf((char *)numbuf, NUMBUFLEN, "%02X", (int)blob_get(blob, i));
ga_concat(&ga, numbuf); ga_concat(&ga, numbuf);
} }
ga_append(&ga, NUL); // append a NUL at the end
*tofree = ga.ga_data; *tofree = ga.ga_data;
return *tofree; return *tofree;
} }

View File

@ -2917,20 +2917,20 @@ nfa_print_state2(FILE *debugf, nfa_state_T *state, garray_T *indent)
ga_concat(indent, (char_u *)"| "); ga_concat(indent, (char_u *)"| ");
else else
ga_concat(indent, (char_u *)" "); ga_concat(indent, (char_u *)" ");
ga_append(indent, '\0'); ga_append(indent, NUL);
nfa_print_state2(debugf, state->out, indent); nfa_print_state2(debugf, state->out, indent);
// replace last part of indent for state->out1 // replace last part of indent for state->out1
indent->ga_len -= 3; indent->ga_len -= 3;
ga_concat(indent, (char_u *)" "); ga_concat(indent, (char_u *)" ");
ga_append(indent, '\0'); ga_append(indent, NUL);
nfa_print_state2(debugf, state->out1, indent); nfa_print_state2(debugf, state->out1, indent);
// shrink indent // shrink indent
indent->ga_len -= 3; indent->ga_len -= 3;
ga_append(indent, '\0'); ga_append(indent, NUL);
} }
/* /*

View File

@ -680,5 +680,12 @@ func Test_list2blob()
call assert_equal(0z00010203, list2blob(range(4))) call assert_equal(0z00010203, list2blob(range(4)))
endfunc endfunc
" The following used to cause an out-of-bounds memory access
func Test_blob2string()
let v = '0z' .. repeat('01010101.', 444)
let v ..= '01'
exe 'let b = ' .. v
call assert_equal(v, string(b))
endfunc
" vim: shiftwidth=2 sts=2 expandtab " vim: shiftwidth=2 sts=2 expandtab

View File

@ -341,7 +341,7 @@ endfunc
func Test_echo_string_partial() func Test_echo_string_partial()
function CountSpaces() function CountSpaces()
endfunction endfunction
echomsg function('CountSpaces', [#{aaaaaaaaaaa: v:false, bbbbbbbbbbbb: '', ccccccccccc: ['ab', 'cd']}]) call assert_equal("function('CountSpaces', [{'ccccccccccc': ['ab', 'cd'], 'aaaaaaaaaaa': v:false, 'bbbbbbbbbbbb': ''}])", string(function('CountSpaces', [#{aaaaaaaaaaa: v:false, bbbbbbbbbbbb: '', ccccccccccc: ['ab', 'cd']}])))
endfunc endfunc
" vim: shiftwidth=2 sts=2 expandtab " vim: shiftwidth=2 sts=2 expandtab

View File

@ -749,6 +749,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
3855,
/**/ /**/
3854, 3854,
/**/ /**/