1 From b7081e135a16091c93f6f5f7525a5c58fb7ca9f9 Mon Sep 17 00:00:00 2001
2 From: Bram Moolenaar <Bram@vim.org>
3 Date: Sat, 4 Sep 2021 18:47:28 +0200
4 Subject: [PATCH] patch 8.2.3402: invalid memory access when using :retab with
7 Problem: Invalid memory access when using :retab with large value.
8 Solution: Check the number is positive.
11 Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
12 Upstream-Status: Backport [https://github.com/vim/vim/commit/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9]
14 src/indent.c | 34 +++++++++++++++++++++-------------
15 src/option.c | 12 ++++++------
16 src/optionstr.c | 4 ++--
17 src/testdir/test_retab.vim | 3 +++
19 5 files changed, 34 insertions(+), 21 deletions(-)
21 Index: git/src/indent.c
22 ===================================================================
23 --- git.orig/src/indent.c
27 * Set the integer values corresponding to the string setting of 'vartabstop'.
28 * "array" will be set, caller must free it if needed.
29 + * Return FAIL for an error.
32 tabstop_set(char_u *var, int **array)
41 if (var[0] == NUL || (var[0] == '0' && var[1] == NUL))
48 for (cp = var; *cp != NUL; ++cp)
49 @@ -43,8 +44,8 @@ tabstop_set(char_u *var, int **array)
55 + semsg(_(e_invarg2), cp);
60 @@ -55,26 +56,33 @@ tabstop_set(char_u *var, int **array)
66 + semsg(_(e_invarg2), var);
70 *array = ALLOC_MULT(int, valcount + 1);
74 (*array)[0] = valcount;
77 for (cp = var; *cp != NUL;)
79 - (*array)[t++] = atoi((char *)cp);
80 - while (*cp != NUL && *cp != ',')
81 + int n = atoi((char *)cp);
83 + if (n < 0 || n > 9999)
85 + semsg(_(e_invarg2), cp);
89 + while (*cp != NUL && *cp != ',')
100 @@ -1556,7 +1564,7 @@ ex_retab(exarg_T *eap)
103 new_ts_str = eap->arg;
104 - if (!tabstop_set(eap->arg, &new_vts_array))
105 + if (tabstop_set(eap->arg, &new_vts_array) == FAIL)
107 while (vim_isdigit(*(eap->arg)) || *(eap->arg) == ',')
109 Index: git/src/option.c
110 ===================================================================
111 --- git.orig/src/option.c
113 @@ -2292,9 +2292,9 @@ didset_options2(void)
116 vim_free(curbuf->b_p_vsts_array);
117 - tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
118 + (void)tabstop_set(curbuf->b_p_vsts, &curbuf->b_p_vsts_array);
119 vim_free(curbuf->b_p_vts_array);
120 - tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
121 + (void)tabstop_set(curbuf->b_p_vts, &curbuf->b_p_vts_array);
125 @@ -5756,7 +5756,7 @@ buf_copy_options(buf_T *buf, int flags)
126 buf->b_p_vsts = vim_strsave(p_vsts);
127 COPY_OPT_SCTX(buf, BV_VSTS);
128 if (p_vsts && p_vsts != empty_option)
129 - tabstop_set(p_vsts, &buf->b_p_vsts_array);
130 + (void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
132 buf->b_p_vsts_array = 0;
133 buf->b_p_vsts_nopaste = p_vsts_nopaste
134 @@ -5914,7 +5914,7 @@ buf_copy_options(buf_T *buf, int flags)
135 buf->b_p_isk = save_p_isk;
137 if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
138 - tabstop_set(p_vts, &buf->b_p_vts_array);
139 + (void)tabstop_set(p_vts, &buf->b_p_vts_array);
141 buf->b_p_vts_array = NULL;
143 @@ -5929,7 +5929,7 @@ buf_copy_options(buf_T *buf, int flags)
144 buf->b_p_vts = vim_strsave(p_vts);
145 COPY_OPT_SCTX(buf, BV_VTS);
146 if (p_vts && p_vts != empty_option && !buf->b_p_vts_array)
147 - tabstop_set(p_vts, &buf->b_p_vts_array);
148 + (void)tabstop_set(p_vts, &buf->b_p_vts_array);
150 buf->b_p_vts_array = NULL;
152 @@ -6634,7 +6634,7 @@ paste_option_changed(void)
153 if (buf->b_p_vsts_array)
154 vim_free(buf->b_p_vsts_array);
155 if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
156 - tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
157 + (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
159 buf->b_p_vsts_array = 0;
161 Index: git/src/optionstr.c
162 ===================================================================
163 --- git.orig/src/optionstr.c
164 +++ git/src/optionstr.c
165 @@ -2166,7 +2166,7 @@ did_set_string_option(
168 int *oldarray = curbuf->b_p_vsts_array;
169 - if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)))
170 + if (tabstop_set(*varp, &(curbuf->b_p_vsts_array)) == OK)
174 @@ -2205,7 +2205,7 @@ did_set_string_option(
176 int *oldarray = curbuf->b_p_vts_array;
178 - if (tabstop_set(*varp, &(curbuf->b_p_vts_array)))
179 + if (tabstop_set(*varp, &(curbuf->b_p_vts_array)) == OK)
183 Index: git/src/testdir/test_retab.vim
184 ===================================================================
185 --- git.orig/src/testdir/test_retab.vim
186 +++ git/src/testdir/test_retab.vim
187 @@ -74,4 +74,7 @@ endfunc
188 func Test_retab_error()
189 call assert_fails('retab -1', 'E487:')
190 call assert_fails('retab! -1', 'E487:')
191 + call assert_fails('ret -1000', 'E487:')
192 + call assert_fails('ret 10000', 'E475:')
193 + call assert_fails('ret 80000000000000000000', 'E475:')
195 Index: git/src/version.c
196 ===================================================================
197 --- git.orig/src/version.c
198 +++ git/src/version.c
199 @@ -743,6 +743,8 @@ static char *(features[]) =
200 static int included_patches[] =
201 { /* Add new patch number below this line */