patch 9.2.0186: heap buffer overflow with long generic function name

Problem:   Using a long generic function name may cause a heap buffer
           overflow in common_function().
Solution:  Allocate memory for the full name instead of using IObuff
           (Kaixuan Li).

closes: #19727

Signed-off-by: Kaixuan Li <kaixuanli0131@gmail.com>
Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/evalfunc.c b/src/evalfunc.c
index 6d40794c05d1bdff88156856e4760a2db883430b..f790aa826a7b8db68a972c9af9a419348fa716d2 100644 (file)
--- a/src/evalfunc.c
+++ b/src/evalfunc.c
@@ -5436,9 +5436,13 @@ common_function(typval_T *argvars, typval_T *rettv, int is_funcref)
            else
            {
                // generic function
-               STRCPY(IObuff, name);
-               STRCAT(IObuff, start_bracket);
-               rettv->vval.v_string = vim_strsave(IObuff);
+               size_t len = STRLEN(name) + STRLEN(start_bracket);
+               rettv->vval.v_string = alloc(len + 1);
+               if (rettv->vval.v_string != NULL)
+               {
+                   STRCPY(rettv->vval.v_string, name);
+                   STRCAT(rettv->vval.v_string, start_bracket);
+               }
                vim_free(name);
            }
        }

diff --git a/src/testdir/test_vimscript.vim b/src/testdir/test_vimscript.vim
index a79c6827911ba0dbc2ad7386787b0d030f0bf400..9248c5d6bc727deb72e1bb6f27861c36576feffe 100644 (file)
--- a/src/testdir/test_vimscript.vim
+++ b/src/testdir/test_vimscript.vim
@@ -7689,6 +7689,19 @@ func Test_catch_pattern_trailing_chars()
   bw!
 endfunc
 
+" Test for long gerneric type name {{{1
+func Test_function_long_generic_name()
+  func TestFunc()
+    return
+  endfunc
+
+  let name = 'TestFunc<' .. repeat('T', 1100) .. '>'
+
+  call function(name)
+  call funcref(name)
+  delfunc TestFunc
+endfunc
+
 "-------------------------------------------------------------------------------
 " Modelines                                                                {{{1
 " vim: ts=8 sw=2 sts=2 expandtab tw=80 fdm=marker

diff --git a/src/version.c b/src/version.c
index 1f2cf0ec2422c0806d14fdaf9e845b3293b96b94..05bc54c3a562697463b8611869fbf0f6c9ee3e50 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    186,
 /**/
     185,
 /**/