Skip to content

Commit c525e3a

Browse files
committed
patch 8.0.0337: invalid memory access in :recover command
Problem: Invalid memory access in :recover command. Solution: Avoid access before directory name. (Dominique Pelle, closes #1488)
1 parent 3df0173 commit c525e3a

File tree

5 files changed

+26
-4
lines changed

5 files changed

+26
-4
lines changed

src/Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2177,6 +2177,7 @@ test_arglist \
21772177
test_pyx2 \
21782178
test_pyx3 \
21792179
test_quickfix \
2180+
test_recover \
21802181
test_regexp_latin \
21812182
test_regexp_utf8 \
21822183
test_reltime \

src/memline.c

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1863,8 +1863,10 @@ recover_names(
18631863
else
18641864
{
18651865
#if defined(UNIX) || defined(WIN3264)
1866-
p = dir_name + STRLEN(dir_name);
1867-
if (after_pathsep(dir_name, p) && p[-1] == p[-2])
1866+
int len = STRLEN(dir_name);
1867+
1868+
p = dir_name + len;
1869+
if (after_pathsep(dir_name, p) && len > 1 && p[-1] == p[-2])
18681870
{
18691871
/* Ends with '//', Use Full path for swap name */
18701872
tail = make_percent_swname(dir_name, fname_res);
@@ -3922,8 +3924,10 @@ makeswapname(
39223924
#endif
39233925

39243926
#if defined(UNIX) || defined(WIN3264) /* Need _very_ long file names */
3925-
s = dir_name + STRLEN(dir_name);
3926-
if (after_pathsep(dir_name, s) && s[-1] == s[-2])
3927+
int len = STRLEN(dir_name);
3928+
3929+
s = dir_name + len;
3930+
if (after_pathsep(dir_name, s) && len > 1 && s[-1] == s[-2])
39273931
{ /* Ends with '//', Use Full path */
39283932
r = NULL;
39293933
if ((s = make_percent_swname(dir_name, fname)) != NULL)

src/testdir/test_alot.vim

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ source test_messages.vim
3434
source test_partial.vim
3535
source test_popup.vim
3636
source test_put.vim
37+
source test_recover.vim
3738
source test_reltime.vim
3839
source test_searchpos.vim
3940
source test_set.vim

src/testdir/test_recover.vim

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
" Test :recover
2+
3+
func Test_recover_root_dir()
4+
" This used to access invalid memory.
5+
split Xtest
6+
set dir=/
7+
call assert_fails('recover', 'E305:')
8+
close!
9+
10+
call assert_fails('split Xtest', 'E303:')
11+
set dir&
12+
endfunc
13+
14+
" TODO: move recover tests from test78.in to here.

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -764,6 +764,8 @@ static char *(features[]) =
764764

765765
static int included_patches[] =
766766
{ /* Add new patch number below this line */
767+
/**/
768+
337,
767769
/**/
768770
336,
769771
/**/

0 commit comments

Comments
 (0)