patch 9.0.1916: Crash when allocating large terminal screen

Problem:  Crash when allocating large terminal screen
Solution: Don't allow values > 1000 for terminal
          screen columns and rows

closes: #13126

Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/runtime/doc/visual.txt b/runtime/doc/visual.txt
index 616e773fe3fc11b2193cc881212547d37969cde3..a91969e41e9725fd649af4af8148cd37158d58fb 100644 (file)
--- a/runtime/doc/visual.txt
+++ b/runtime/doc/visual.txt
@@ -183,7 +183,7 @@ If you want to highlight exactly the same area as the last time, you can use
 CTRL-C                 In Visual mode: Stop Visual mode.  When insert mode is
                        pending (the mode message shows
                        "-- (insert) VISUAL --"), it is also stopped.
-                       On MS-Windows, you may need to press CTRL-Break 
+                       On MS-Windows, you may need to press CTRL-Break
                        |dos-CTRL-Break|.
 
 ==============================================================================

diff --git a/src/libvterm/src/screen.c b/src/libvterm/src/screen.c
index 53564be16befd39c9068cc79c64cfec847cea710..7b3322b639f29eb494a684488fcc62ae4874f4ea 100644 (file)
--- a/src/libvterm/src/screen.c
+++ b/src/libvterm/src/screen.c
@@ -776,9 +776,15 @@ static int resize(int new_rows, int new_cols, VTermStateFields *fields, void *us
     if(screen->sb_buffer)
       vterm_allocator_free(screen->vt, screen->sb_buffer);
 
+    if (new_cols > 1000)
+      new_cols = 1000;
+
     screen->sb_buffer = vterm_allocator_malloc(screen->vt, sizeof(VTermScreenCell) * new_cols);
   }
 
+  if (new_rows > 1000)
+    new_rows = 1000;
+
   resize_buffer(screen, 0, new_rows, new_cols, !altscreen_active, fields);
   if(screen->buffers[BUFIDX_ALTSCREEN])
     resize_buffer(screen, 1, new_rows, new_cols, altscreen_active, fields);

diff --git a/src/terminal.c b/src/terminal.c
index cb889ae19a44b4bac650782eca9447adac67b60a..991f05652be90dc1f06b0e4d298aa8c41c25a00e 100644 (file)
--- a/src/terminal.c
+++ b/src/terminal.c
@@ -272,6 +272,10 @@ parse_termwinsize(win_T *wp, int *rows, int *cols)
     }
     *rows = atoi((char *)wp->w_p_tws);
     *cols = atoi((char *)p + 1);
+    if (*rows > 1000)
+       *rows = 1000;
+    if (*cols > 1000)
+       *cols = 1000;
     return minsize;
 }
 

diff --git a/src/testdir/test_terminal2.vim b/src/testdir/test_terminal2.vim
index 8615bf55ad48ff23c0b35898a96601537f95b106..6ce531ed4542c95a347a103f3c077f2b0468c012 100644 (file)
--- a/src/testdir/test_terminal2.vim
+++ b/src/testdir/test_terminal2.vim
@@ -64,6 +64,14 @@ func Test_terminal_termwinsize_option_zero()
   call StopShellInTerminal(buf)
   exe buf . 'bwipe'
 
+  " This used to crash Vim
+  set termwinsize=10000*10000
+  let buf = Run_shell_in_terminal({})
+  let win = bufwinid(buf)
+  call assert_equal([1000, 1000], term_getsize(buf))
+  call StopShellInTerminal(buf)
+  exe buf . 'bwipe'
+
   set termwinsize=
 endfunc
 
@@ -271,6 +279,25 @@ func Test_terminal_resize()
   set statusline&
 endfunc
 
+func Test_terminal_resize2()
+  CheckNotMSWindows
+  set statusline=x
+  terminal
+  call assert_equal(2, winnr('$'))
+  let buf = bufnr()
+
+  " Wait for the shell to display a prompt
+  call WaitForAssert({-> assert_notequal('', term_getline(buf, 1))})
+
+  " This used to crash Vim
+  call feedkeys("printf '\033[8;99999;99999t'\<CR>", 'xt')
+  redraw
+
+  call feedkeys("exit\<CR>", 'xt')
+  call TermWait(buf)
+  set statusline&
+endfunc
+
 " must be nearly the last, we can't go back from GUI to terminal
 func Test_zz1_terminal_in_gui()
   CheckCanRunGui

diff --git a/src/version.c b/src/version.c
index 03cb97fd05dc17d027dc2967d565553b3b0fce53..110a8403974027108a1ca4dc69e8dc36b6667428 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -699,6 +699,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1916,
 /**/
     1915,
 /**/