diff options
| author | Bram Moolenaar <Bram@vim.org> | 2012-09-18 18:03:37 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2012-09-18 18:03:37 +0200 |
| commit | 4fabd7dd4a2f77bc741eda58126d529f26f16a8d (patch) | |
| tree | 8b6409274dea43bfdfb027cf776f8ab0397df856 | |
| parent | be1e9e9fc1f31e3d0b82eb3febd51923bda2a1e4 (diff) | |
updated for version 7.3.664v7.3.664
Problem: Buffer overflow in unescaping text. (Raymond Ko)
Solution: Limit check for multi-byte character to 4 bytes.
| -rw-r--r-- | src/mbyte.c | 14 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 12 insertions, 4 deletions
diff --git a/src/mbyte.c b/src/mbyte.c index ca3204f214..33e894e88c 100644 --- a/src/mbyte.c +++ b/src/mbyte.c @@ -3793,13 +3793,15 @@ mb_charlen_len(str, len) mb_unescape(pp) char_u **pp; { - static char_u buf[MB_MAXBYTES + 1]; - int n, m = 0; + static char_u buf[6]; + int n; + int m = 0; char_u *str = *pp; /* Must translate K_SPECIAL KS_SPECIAL KE_FILLER to K_SPECIAL and CSI - * KS_EXTRA KE_CSI to CSI. */ - for (n = 0; str[n] != NUL && m <= MB_MAXBYTES; ++n) + * KS_EXTRA KE_CSI to CSI. + * Maximum length of a utf-8 character is 4 bytes. */ + for (n = 0; str[n] != NUL && m < 4; ++n) { if (str[n] == K_SPECIAL && str[n + 1] == KS_SPECIAL @@ -3836,6 +3838,10 @@ mb_unescape(pp) *pp = str + n + 1; return buf; } + + /* Bail out quickly for ASCII. */ + if (buf[0] < 128) + break; } return NULL; } diff --git a/src/version.c b/src/version.c index 43d11611bd..d8ada6990e 100644 --- a/src/version.c +++ b/src/version.c @@ -720,6 +720,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 664, +/**/ 663, /**/ 662, |