patch 9.2.0273: tabpanel: undefined behaviour with large tabpanelop columns

Problem:  tabpanel: undefined behaviour with large tabpanelop columns
          (Michał Majchrowicz)
Solution: Error out for too large column values

Co-authored-by: Michał Majchrowicz <mmajchrowicz@afine.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/tabpanel.c b/src/tabpanel.c
index 12d6446832e6c7c014ddc503e54b9ab43dff3b5d..c47b6b6e470f3de4d72a3085a414bcfd6a53ccf5 100644 (file)
--- a/src/tabpanel.c
+++ b/src/tabpanel.c
@@ -57,7 +57,7 @@ tabpanelopt_changed(void)
 {
     char_u     *p;
     int                new_align = ALIGN_LEFT;
-    int                new_columns = 20;
+    long       new_columns = 20;
     int                new_is_vert = FALSE;
 
     p = p_tplo;
@@ -83,6 +83,8 @@ tabpanelopt_changed(void)
        {
            p += 8;
            new_columns = getdigits(&p);
+           if (new_columns < 1 || new_columns > 1000)
+               return FAIL;
        }
        else if (STRNCMP(p, "vert", 4) == 0)
        {

diff --git a/src/testdir/test_tabpanel.vim b/src/testdir/test_tabpanel.vim
index 4837a643d50f619341ea7354d49d00484ba13b05..0329dd7a4cbd2440a585ad01cbc8b6a8a8560f68 100644 (file)
--- a/src/testdir/test_tabpanel.vim
+++ b/src/testdir/test_tabpanel.vim
@@ -887,4 +887,9 @@ func Test_tabpanel_no_modeline()
   bw!
 endfunc
 
+func Test_tabpanel_large_columns()
+  call assert_fails(':set tabpanelopt=columns:10001', 'E474:')
+  call assert_fails(':set tabpanelopt=columns:-1', 'E474:')
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 7ea6b064f6159f5b74d30a114ce31212a9bda3ab..35702fe0c66ab994d5aed34bdb5f5817c3d5c1fe 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    273,
 /**/
     272,
 /**/