diff options
author | Christian Brabandt <cb@256bit.org> | 2023-11-14 22:42:59 +0100 |
---|---|---|
committer | Christian Brabandt <cb@256bit.org> | 2023-11-16 22:04:38 +0100 |
commit | 6bf131888a3d1de62bbfa8a7ea03c0ddccfd496e (patch) | |
tree | db7b6854a3ba228733800239540e12dabe6f69e4 /src/testdir | |
parent | 73b2d3790cad5694fc0ed0db2926e4220c48d968 (diff) |
patch 9.0.2112: [security]: overflow in shift_linev9.0.2112
Problem: [security]: overflow in shift_line
Solution: allow a max indent of INT_MAX
[security]: overflow in shift_line
When shifting lines in operator pending mode and using a very large
value, we may overflow the size of integer. Fix this by using a long
variable, testing if the result would be larger than INT_MAX and if so,
indent by INT_MAX value.
Special case: We cannot use long here, since on 32bit architectures (or
on Windows?), it typically cannot take larger values than a plain int,
so we have to use long long count, decide whether the resulting
multiplication of the shiftwidth value * amount is larger than INT_MAX
and if so, we will store INT_MAX as possible larges value in the long
long count variable.
Then we can safely cast it back to int when calling the functions to set
the indent (set_indent() or change_indent()). So this should be safe.
Add a test that when using a huge value in operator pending mode for
shifting, we will shift by INT_MAX
closes: #13535
Signed-off-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/testdir')
-rw-r--r-- | src/testdir/test_indent.vim | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/testdir/test_indent.vim b/src/testdir/test_indent.vim index 96e9d23008..217a7ae625 100644 --- a/src/testdir/test_indent.vim +++ b/src/testdir/test_indent.vim @@ -275,4 +275,15 @@ func Test_formatting_keeps_first_line_indent() bwipe! endfunc +" Test for indenting with large amount, causes overflow +func Test_indent_overflow_count() + new + setl sw=8 + call setline(1, "abc") + norm! V2147483647> + " indents by INT_MAX + call assert_equal(2147483647, indent(1)) + close! +endfunc + " vim: shiftwidth=2 sts=2 expandtab |