patch 8.2.3244: Lua 5.3 print() with a long string crashes

Problem:    Lua 5.3 print() with a long string crashes.
Solution:   Use a growarray instead of a Lua buffer. (Yegappan Lakshmanan,
            closes #8655)

diff --git a/src/if_lua.c b/src/if_lua.c
index 5810401633b2fb055625a867e7cc0ac60401ee8a..a3bb0b96bdb830ce59207c92eee20e7e21bb77bd 100644 (file)
--- a/src/if_lua.c
+++ b/src/if_lua.c
@@ -1720,11 +1720,12 @@ static const luaL_Reg luaV_Window_mt[] = {
     static int
 luaV_print(lua_State *L)
 {
-    int i, n = lua_gettop(L); // nargs
-    const char *s;
-    size_t l;
-    luaL_Buffer b;
-    luaL_buffinit(L, &b);
+    int                i, n = lua_gettop(L); // nargs
+    const char *s;
+    size_t     l;
+    garray_T   msg_ga;
+
+    ga_init2(&msg_ga, 1, 128);
     lua_getglobal(L, "tostring");
     for (i = 1; i <= n; i++)
     {
@@ -1735,13 +1736,19 @@ luaV_print(lua_State *L)
        if (s == NULL)
            return luaL_error(L, "cannot convert to string");
        if (i > 1)
-           luaL_addchar(&b, ' '); // use space instead of tab
-       luaV_addlstring(&b, s, l, 0);
+           ga_append(&msg_ga, ' '); // use space instead of tab
+       ga_concat_len(&msg_ga, (char_u *)s, l);
        lua_pop(L, 1);
     }
-    luaL_pushresult(&b);
+    // Replace any "\n" with "\0"
+    for (i = 0; i < msg_ga.ga_len; i++)
+       if (((char *)msg_ga.ga_data)[i] == '\n')
+           ((char *)msg_ga.ga_data)[i] = '\0';
+    lua_pushlstring(L, msg_ga.ga_data, msg_ga.ga_len);
     if (!got_int)
        luaV_msg(L);
+
+    ga_clear(&msg_ga);
     return 0;
 }
 

diff --git a/src/misc2.c b/src/misc2.c
index bc984b219839d7536309404e96f38d8f227046d5..bbf55bb00cc8975687f6f26fba5f43c3a4c2f965 100644 (file)
--- a/src/misc2.c
+++ b/src/misc2.c
@@ -1565,6 +1565,22 @@ ga_concat(garray_T *gap, char_u *s)
     }
 }
 
+/*
+ * Concatenate 'len' bytes from string 's' to a growarray.
+ * When "s" is NULL does not do anything.
+ */
+    void
+ga_concat_len(garray_T *gap, char_u *s, size_t len)
+{
+    if (s == NULL || *s == NUL)
+       return;
+    if (ga_grow(gap, len) == OK)
+    {
+       mch_memmove((char *)gap->ga_data + gap->ga_len, s, (size_t)len);
+       gap->ga_len += len;
+    }
+}
+
 /*
  * Append one byte to a growarray which contains bytes.
  */

diff --git a/src/proto/misc2.pro b/src/proto/misc2.pro
index 5ecd5958fdda2dcefcab7bd07e518503af69d046..a9e2b844c2fe9beea8232dfe1cec0462b3cf4914 100644 (file)
--- a/src/proto/misc2.pro
+++ b/src/proto/misc2.pro
@@ -45,6 +45,7 @@ int ga_grow_inner(garray_T *gap, int n);
 char_u *ga_concat_strings(garray_T *gap, char *sep);
 int ga_add_string(garray_T *gap, char_u *p);
 void ga_concat(garray_T *gap, char_u *s);
+void ga_concat_len(garray_T *gap, char_u *s, size_t len);
 void ga_append(garray_T *gap, int c);
 void append_ga_line(garray_T *gap);
 int simplify_key(int key, int *modifiers);

diff --git a/src/version.c b/src/version.c
index c0aa0d99813aa877f229564785d933a59fb8afd1..b0e67ed0b99387911f1b57ca73763e08573467c2 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -755,6 +755,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3244,
 /**/
     3243,
 /**/