thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 8.1.1143: may pass weird strings to file name expansion

Browse Source 
Problem:    May pass weird strings to file name expansion.
Solution:   Check for matching characters.  Disallow control characters.
This commit is contained in:
Bram Moolenaar
2019-04-10 22:15:19 +02:00
parent 3fb01a53c6
commit 8f130eda47
7 changed files with 57 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
src/option.c
View File

@@ -6005,6 +6005,21 @@ set_string_option(
return r;
}
/*
* Return TRUE if "val" is a valid name: only consists of alphanumeric ASCII
* characters or characters in "allowed".
*/
static int
valid_name(char_u *val, char *allowed)
{
char_u *s;
for (s = val; *s != NUL; ++s)
if (!ASCII_ISALNUM(*s) && vim_strchr((char_u *)allowed, *s) == NULL)
return FALSE;
return TRUE;
}
/*
* Return TRUE if "val" is a valid 'filetype' name.
* Also used for 'syntax' and 'keymap'.
@@ -6012,12 +6027,16 @@ set_string_option(
static int
valid_filetype(char_u *val)
{
char_u *s;
return valid_name(val, ".-_");
}
for (s = val; *s != NUL; ++s)
if (!ASCII_ISALNUM(*s) && vim_strchr((char_u *)".-_", *s) == NULL)
return FALSE;
return TRUE;
/*
* Return TRUE if "val" is a valid 'spellang' value.
*/
int
valid_spellang(char_u *val)
{
return valid_name(val, ".-_,");
}
/*
@@ -7082,7 +7101,10 @@ did_set_string_option(
else if (varp == &(curwin->w_s->b_p_spl)
|| varp == &(curwin->w_s->b_p_spf))
{
errmsg = did_set_spell_option(varp == &(curwin->w_s->b_p_spf));
if (!valid_spellang(*varp))
errmsg = e_invarg;
else
errmsg = did_set_spell_option(varp == &(curwin->w_s->b_p_spf));
}
/* When 'spellcapcheck' is set compile the regexp program. */
else if (varp == &(curwin->w_s->b_p_spc))
@@ -7737,7 +7759,8 @@ did_set_string_option(
break;
if (p > q)
{
vim_snprintf((char *)fname, 200, "spell/%.*s.vim", (int)(p - q), q);
vim_snprintf((char *)fname, 200, "spell/%.*s.vim",
(int)(p - q), q);
source_runtime(fname, DIP_ALL);
}
}