patch 9.1.1469: potential buffer-underflow with invalid hl_id

Problem:  potential buffer-underflow with invalid hl_id (mugitya03)
Solution: assert that the return-code of syn_get_final_id() if > 0

As a safety check, syn_get_final_id() may return zero when either the
provided hl_id is zero or larger than expected.

However, many callers of syn_get_final_id() do not check that the return
value is larger than zero but re-use the returned highlight id directly
like this:

  hl_id = syn_get_final_id(hl_id);
  sgp = &HL_TABLE()[hl_id - 1];	    // index is ID minus one

in which case, this would cause a buffer underrun and an access violation.

Let's use assert(hl_id > 0); to make sure that hl_id is larger than
zero.

Note to myself: I'll need to compile releases builds using -DNDEBUG once
a new release will be made

fixes: #17475
closes: #17512

Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/Makefile b/Makefile
index 4d726991d39d7ba27550748590dda8999e309521..9de75e3464396bc25865629a92563859775c5d53 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -115,6 +115,7 @@ MINOR = 1
 # - With these features: "make depend" (works best with gcc).
 # - If you have a lint program: "make lint" and check the output (ignore GTK
 #   warnings).
+# - compile release versions using -DNDEBUG to disable assert()s
 # - If you have valgrind, enable it in src/testdir/Makefile and run "make
 #   test".  Enable EXITFREE, disable GUI, scheme and tcl to avoid false alarms.
 #   Check the valgrind output.

diff --git a/src/highlight.c b/src/highlight.c
index 807753a303ff4a98d99a605b5e2e766f64335069..ec3d11568c28cb70c0ae9582d79567d91a715ea9 100644 (file)
--- a/src/highlight.c
+++ b/src/highlight.c
@@ -3689,6 +3689,8 @@ syn_id2attr(int hl_id)
     hl_group_T *sgp;
 
     hl_id = syn_get_final_id(hl_id);
+    // shouldn't happen
+    assert(hl_id > 0);
     sgp = &HL_TABLE()[hl_id - 1];          // index is ID minus one
 
 #ifdef FEAT_GUI
@@ -3716,6 +3718,8 @@ syn_id2colors(int hl_id, guicolor_T *fgp, guicolor_T *bgp)
     hl_group_T *sgp;
 
     hl_id = syn_get_final_id(hl_id);
+    // shouldn't happen
+    assert(hl_id > 0);
     sgp = &HL_TABLE()[hl_id - 1];          // index is ID minus one
 
     *fgp = sgp->sg_gui_fg;
@@ -3734,6 +3738,8 @@ syn_id2cterm_bg(int hl_id, int *fgp, int *bgp)
     hl_group_T *sgp;
 
     hl_id = syn_get_final_id(hl_id);
+    // shouldn't happen
+    assert(hl_id > 0);
     sgp = &HL_TABLE()[hl_id - 1];          // index is ID minus one
     *fgp = sgp->sg_cterm_fg - 1;
     *bgp = sgp->sg_cterm_bg - 1;

diff --git a/src/version.c b/src/version.c
index 04c11f76ce2d64e2ddbb31d40f286d19f5760f64..8b4f3e7637575a4a498c52ecdc2128acec54c0b2 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -709,6 +709,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1469,
 /**/
     1468,
 /**/