Skip to content

Commit e091a4b

Browse files
splhacksplhack
committed
Merge remote-tracking branch 'vim/master'
2 parents 88c8df3 + c812996 commit e091a4b

File tree

20 files changed

+207
-54
lines changed

20 files changed

+207
-54
lines changed

‎src/Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2167,6 +2167,7 @@ test_arglist \
21672167
test_perl \
21682168
test_popup \
21692169
test_profile \
2170+
test_put \
21702171
test_quickfix \
21712172
test_regexp_latin \
21722173
test_regexp_utf8 \

‎src/charset.c‎

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1901,7 +1901,11 @@ vim_str2nr(
19011901
n += 2; /* skip over "0b" */
19021902
while ('0' <= *ptr && *ptr <= '1')
19031903
{
1904-
un = 2 * un + (unsigned long)(*ptr - '0');
1904+
/* avoid ubsan error for overflow */
1905+
if (un < UVARNUM_MAX / 2)
1906+
un = 2 * un + (unsigned long)(*ptr - '0');
1907+
else
1908+
un = UVARNUM_MAX;
19051909
++ptr;
19061910
if (n++ == maxlen)
19071911
break;
@@ -1912,7 +1916,11 @@ vim_str2nr(
19121916
/* octal */
19131917
while ('0' <= *ptr && *ptr <= '7')
19141918
{
1915-
un = 8 * un + (uvarnumber_T)(*ptr - '0');
1919+
/* avoid ubsan error for overflow */
1920+
if (un < UVARNUM_MAX / 8)
1921+
un = 8 * un + (uvarnumber_T)(*ptr - '0');
1922+
else
1923+
un = UVARNUM_MAX;
19161924
++ptr;
19171925
if (n++ == maxlen)
19181926
break;
@@ -1925,7 +1933,11 @@ vim_str2nr(
19251933
n += 2; /* skip over "0x" */
19261934
while (vim_isxdigit(*ptr))
19271935
{
1928-
un = 16 * un + (uvarnumber_T)hex2nr(*ptr);
1936+
/* avoid ubsan error for overflow */
1937+
if (un < UVARNUM_MAX / 16)
1938+
un = 16 * un + (uvarnumber_T)hex2nr(*ptr);
1939+
else
1940+
un = UVARNUM_MAX;
19291941
++ptr;
19301942
if (n++ == maxlen)
19311943
break;
@@ -1936,7 +1948,11 @@ vim_str2nr(
19361948
/* decimal */
19371949
while (VIM_ISDIGIT(*ptr))
19381950
{
1939-
un = 10 * un + (uvarnumber_T)(*ptr - '0');
1951+
/* avoid ubsan error for overflow */
1952+
if (un < UVARNUM_MAX / 10)
1953+
un = 10 * un + (uvarnumber_T)(*ptr - '0');
1954+
else
1955+
un = UVARNUM_MAX;
19401956
++ptr;
19411957
if (n++ == maxlen)
19421958
break;
@@ -1950,9 +1966,19 @@ vim_str2nr(
19501966
if (nptr != NULL)
19511967
{
19521968
if (negative) /* account for leading '-' for decimal numbers */
1953-
*nptr = -(varnumber_T)un;
1969+
{
1970+
/* avoid ubsan error for overflow */
1971+
if (un > VARNUM_MAX)
1972+
*nptr = VARNUM_MIN;
1973+
else
1974+
*nptr = -(varnumber_T)un;
1975+
}
19541976
else
1977+
{
1978+
if (un > VARNUM_MAX)
1979+
un = VARNUM_MAX;
19551980
*nptr = (varnumber_T)un;
1981+
}
19561982
}
19571983
if (unptr != NULL)
19581984
*unptr = un;

‎src/eval.c‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4109,21 +4109,12 @@ eval6(
41094109
{
41104110
if (n2 == 0) /* give an error message? */
41114111
{
4112-
#ifdef FEAT_NUM64
41134112
if (n1 == 0)
4114-
n1 = -0x7fffffffffffffffLL - 1; /* similar to NaN */
4113+
n1 = VARNUM_MIN; /* similar to NaN */
41154114
else if (n1 < 0)
4116-
n1 = -0x7fffffffffffffffLL;
4115+
n1 = -VARNUM_MAX;
41174116
else
4118-
n1 = 0x7fffffffffffffffLL;
4119-
#else
4120-
if (n1 == 0)
4121-
n1 = -0x7fffffffL - 1L; /* similar to NaN */
4122-
else if (n1 < 0)
4123-
n1 = -0x7fffffffL;
4124-
else
4125-
n1 = 0x7fffffffL;
4126-
#endif
4117+
n1 = VARNUM_MAX;
41274118
}
41284119
else
41294120
n1 = n1 / n2;

‎src/evalfunc.c‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3304,21 +3304,12 @@ f_float2nr(typval_T *argvars, typval_T *rettv)
33043304

33053305
if (get_float_arg(argvars, &f) == OK)
33063306
{
3307-
# ifdef FEAT_NUM64
3308-
if (f < -0x7fffffffffffffffLL)
3309-
rettv->vval.v_number = -0x7fffffffffffffffLL;
3310-
else if (f > 0x7fffffffffffffffLL)
3311-
rettv->vval.v_number = 0x7fffffffffffffffLL;
3307+
if (f < -VARNUM_MAX)
3308+
rettv->vval.v_number = -VARNUM_MAX;
3309+
else if (f > VARNUM_MAX)
3310+
rettv->vval.v_number = VARNUM_MAX;
33123311
else
33133312
rettv->vval.v_number = (varnumber_T)f;
3314-
# else
3315-
if (f < -0x7fffffff)
3316-
rettv->vval.v_number = -0x7fffffff;
3317-
else if (f > 0x7fffffff)
3318-
rettv->vval.v_number = 0x7fffffff;
3319-
else
3320-
rettv->vval.v_number = (varnumber_T)f;
3321-
# endif
33223313
}
33233314
}
33243315

‎src/ex_docmd.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4116,6 +4116,12 @@ set_one_cmd_context(
41164116
case CMD_echoerr:
41174117
case CMD_call:
41184118
case CMD_return:
4119+
case CMD_cexpr:
4120+
case CMD_caddexpr:
4121+
case CMD_cgetexpr:
4122+
case CMD_lexpr:
4123+
case CMD_laddexpr:
4124+
case CMD_lgetexpr:
41194125
set_context_for_expression(xp, arg, ea.cmdidx);
41204126
break;
41214127

‎src/json.c‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -629,10 +629,13 @@ json_decode_item(js_read_T *reader, typval_T *res, int options)
629629
key = p = reader->js_buf + reader->js_used;
630630
while (*p != NUL && *p != ':' && *p > ' ')
631631
++p;
632-
cur_item->v_type = VAR_STRING;
633-
cur_item->vval.v_string = vim_strnsave(key, (int)(p - key));
632+
if (cur_item != NULL)
633+
{
634+
cur_item->v_type = VAR_STRING;
635+
cur_item->vval.v_string = vim_strnsave(key, (int)(p - key));
636+
top_item->jd_key = cur_item->vval.v_string;
637+
}
634638
reader->js_used += (int)(p - key);
635-
top_item->jd_key = cur_item->vval.v_string;
636639
}
637640
else
638641
{
@@ -1053,7 +1056,8 @@ json_decode(js_read_T *reader, typval_T *res, int options)
10531056

10541057
/*
10551058
* Decode the JSON from "reader" to find the end of the message.
1056-
* "options" can be JSON_JS or zero;
1059+
* "options" can be JSON_JS or zero.
1060+
* This is only used for testing.
10571061
* Return FAIL if the message has a decoding error.
10581062
* Return MAYBE if the message is truncated, need to read more.
10591063
* This only works reliable if the message contains an object, array or

‎src/json_test.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,12 @@ test_decode_find_end(void)
107107
reader.js_buf = (char_u *)" { ";
108108
assert(json_find_end(&reader, 0) == MAYBE);
109109

110+
/* JS object with white space */
111+
reader.js_buf = (char_u *)" { a : 123 } ";
112+
assert(json_find_end(&reader, JSON_JS) == OK);
113+
reader.js_buf = (char_u *)" { a : ";
114+
assert(json_find_end(&reader, JSON_JS) == MAYBE);
115+
110116
/* array without white space */
111117
reader.js_buf = (char_u *)"[\"a\",123]";
112118
assert(json_find_end(&reader, 0) == OK);

‎src/keymap.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -496,9 +496,10 @@ enum key_extra
496496

497497
/*
498498
* The length of the longest special key name, including modifiers.
499-
* Current longest is <M-C-S-T-4-MiddleRelease> (length includes '<' and '>').
499+
* Current longest is <M-C-S-T-D-A-4-ScrollWheelRight> (length includes '<' and
500+
* '>').
500501
*/
501-
#define MAX_KEY_NAME_LEN 25
502+
#define MAX_KEY_NAME_LEN 32
502503

503504
/* Maximum length of a special key event as tokens. This includes modifiers.
504505
* The longest event is something like <M-C-S-T-4-LeftDrag> which would be the

‎src/misc1.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2180,7 +2180,7 @@ ins_char(int c)
21802180
char_u buf[MB_MAXBYTES + 1];
21812181
int n = 1;
21822182

2183-
#if defined(FEAT_MBYTE) || defined(PROTO)
2183+
#ifdef FEAT_MBYTE
21842184
n = (*mb_char2bytes)(c, buf);
21852185

21862186
/* When "c" is 0x100, 0x200, etc. we don't want to insert a NUL byte.

‎src/misc2.c‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2162,6 +2162,7 @@ static struct modmasktable
21622162
/* 'A' must be the last one */
21632163
{MOD_MASK_ALT, MOD_MASK_ALT, (char_u)'A'},
21642164
{0, 0, NUL}
2165+
/* NOTE: when adding an entry, update MAX_KEY_NAME_LEN! */
21652166
};
21662167

21672168
/*
@@ -2437,6 +2438,7 @@ static struct key_name_entry
24372438
{K_SWIPEDOWN, (char_u *)"SwipeDown"},
24382439
#endif
24392440
{0, NULL}
2441+
/* NOTE: When adding a long name update MAX_KEY_NAME_LEN. */
24402442
};
24412443

24422444
#define KEY_NAMES_TABLE_LEN (sizeof(key_names_table) / sizeof(struct key_name_entry))
@@ -2665,8 +2667,13 @@ get_special_key_name(int c, int modifiers)
26652667
}
26662668
else /* use name of special key */
26672669
{
2668-
STRCPY(string + idx, key_names_table[table_idx].name);
2669-
idx = (int)STRLEN(string);
2670+
size_t len = STRLEN(key_names_table[table_idx].name);
2671+
2672+
if (len + idx + 2 <= MAX_KEY_NAME_LEN)
2673+
{
2674+
STRCPY(string + idx, key_names_table[table_idx].name);
2675+
idx += (int)len;
2676+
}
26702677
}
26712678
string[idx++] = '>';
26722679
string[idx] = NUL;

0 commit comments

Comments
 (0)