6.2.187

   1 To: vim-dev@vim.org
   2 Subject: Patch 6.2.187
   3 Fcc: outbox
   4 From: Bram Moolenaar <Bram@moolenaar.net>
   5 Mime-Version: 1.0
   6 Content-Type: text/plain; charset=ISO-8859-1
   7 Content-Transfer-Encoding: 8bit
   8 ------------
   9
  10 Patch 6.2.187
  11 Problem:    Using Insure++ reveals a number of bugs.  (Dominuque Pelle)
  12 Solution:   Initialize variables where needed.  Free allocated memory to avoid
  13             leaks.  Fix comparing tags to avoid reading past allocated memory.
  14 Files:      src/buffer.c, src/diff.c, src/fileio.c, src/mark.c, src/misc1.c,
  15             src/misc2.c, src/ops.c, src/option.c, src/tag.c, src/ui.c
  16
  17
  18 *** ../vim-6.2.186/src/buffer.c Sun Nov  9 20:35:08 2003
  19 --- src/buffer.c        Thu Jan 15 22:10:02 2004
  20 ***************
  21 *** 4085,4090 ****
  22 --- 4085,4091 ----
  23   #ifdef FEAT_AUTOCMD
  24       --autocmd_no_leave;
  25   #endif
  26 +     vim_free(opened);
  27   }
  28
  29   # if defined(FEAT_LISTCMDS) || defined(PROTO)
  30 *** ../vim-6.2.186/src/diff.c   Sun Oct 27 19:28:04 2002
  31 --- src/diff.c  Fri Jan 16 11:52:11 2004
  32 ***************
  33 *** 952,958 ****
  34         curwin = wp;
  35         curbuf = curwin->w_buffer;
  36         set_string_option_direct((char_u *)"fdm", -1, (char_u *)"diff",
  37 !                                                                  OPT_LOCAL);
  38         curwin = old_curwin;
  39         curbuf = curwin->w_buffer;
  40         wp->w_p_fdc = 2;
  41 --- 952,958 ----
  42         curwin = wp;
  43         curbuf = curwin->w_buffer;
  44         set_string_option_direct((char_u *)"fdm", -1, (char_u *)"diff",
  45 !                                                         OPT_LOCAL|OPT_FREE);
  46         curwin = old_curwin;
  47         curbuf = curwin->w_buffer;
  48         wp->w_p_fdc = 2;
  49 *** ../vim-6.2.186/src/fileio.c Fri Jan  9 14:33:14 2004
  50 --- src/fileio.c        Thu Jan 15 22:07:40 2004
  51 ***************
  52 *** 3233,3239 ****
  53
  54   #if defined(UNIX) && !defined(ARCHIE)
  55       /* When using ":w!" and the file was read-only: make it writable */
  56 !     if (forceit && st_old.st_uid == getuid() && perm >= 0 && !(perm & 0200)
  57                                      && vim_strchr(p_cpo, CPO_FWRITE) == NULL)
  58       {
  59         perm |= 0200;
  60 --- 3262,3268 ----
  61
  62   #if defined(UNIX) && !defined(ARCHIE)
  63       /* When using ":w!" and the file was read-only: make it writable */
  64 !     if (forceit && perm >= 0 && !(perm & 0200) && st_old.st_uid == getuid()
  65                                      && vim_strchr(p_cpo, CPO_FWRITE) == NULL)
  66       {
  67         perm |= 0200;
  68 *** ../vim-6.2.186/src/mark.c   Sat Sep 27 19:36:47 2003
  69 --- src/mark.c  Fri Jan 16 11:56:14 2004
  70 ***************
  71 *** 1140,1151 ****
  72         name = buflist_nr2name(fm->fmark.fnum, TRUE, FALSE);
  73       else
  74         name = fm->fname;               /* use name from .viminfo */
  75 !     if (name == NULL || *name == NUL)
  76 !       return;
  77 !
  78 !     fprintf(fp, "%c%c  %ld  %ld  ", c1, c2, (long)fm->fmark.mark.lnum,
  79                                                     (long)fm->fmark.mark.col);
  80 !     viminfo_writestring(fp, name);
  81       if (fm->fmark.fnum != 0)
  82         vim_free(name);
  83   }
  84 --- 1145,1157 ----
  85         name = buflist_nr2name(fm->fmark.fnum, TRUE, FALSE);
  86       else
  87         name = fm->fname;               /* use name from .viminfo */
  88 !     if (name != NULL && *name != NUL)
  89 !     {
  90 !       fprintf(fp, "%c%c  %ld  %ld  ", c1, c2, (long)fm->fmark.mark.lnum,
  91                                                     (long)fm->fmark.mark.col);
  92 !       viminfo_writestring(fp, name);
  93 !     }
  94 !
  95       if (fm->fmark.fnum != 0)
  96         vim_free(name);
  97   }
  98 *** ../vim-6.2.186/src/misc1.c  Sun Jan 18 20:15:02 2004
  99 --- src/misc1.c Sun Jan 18 16:07:34 2004
 100 ***************
 101 *** 1368,1373 ****
 102 --- 1368,1374 ----
 103         curwin->w_cursor.coladd = 0;
 104   #endif
 105         ins_bytes(p_extra);     /* will call changed_bytes() */
 106 +       vim_free(p_extra);
 107         next_line = NULL;
 108       }
 109   #endif
 110 *** ../vim-6.2.186/src/misc2.c  Sat Sep 27 19:36:47 2003
 111 --- src/misc2.c Fri Jan 16 15:19:08 2004
 112 ***************
 113 *** 2129,2135 ****
 114       char_u    *dst;
 115       int               keycode; /* prefer key code, e.g. K_DEL instead of DEL */
 116   {
 117 !     int               modifiers;
 118       int               key;
 119       int               dlen = 0;
 120
 121 --- 2129,2135 ----
 122       char_u    *dst;
 123       int               keycode; /* prefer key code, e.g. K_DEL instead of DEL */
 124   {
 125 !     int               modifiers = 0;
 126       int               key;
 127       int               dlen = 0;
 128
 129 ***************
 130 *** 4368,4373 ****
 131 --- 4368,4376 ----
 132       while (vl != NULL)
 133       {
 134         vp = vl->ffv_next;
 135 + #ifdef FEAT_PATH_EXTRA
 136 +       vim_free(vl->ffv_wc_path);
 137 + #endif
 138         vim_free(vl);
 139         vl = vp;
 140       }
 141 *** ../vim-6.2.186/src/ops.c    Sun Oct 12 16:56:43 2003
 142 --- src/ops.c   Thu Jan 15 22:30:37 2004
 143 ***************
 144 *** 5610,5619 ****
 145         if (s == NULL)
 146             break;
 147         if (extra)
 148 -       {
 149             mch_memmove(s, y_ptr->y_array[lnum], (size_t)extra);
 150             vim_free(y_ptr->y_array[lnum]);
 151 -       }
 152         if (i)
 153             mch_memmove(s + extra, str + start, (size_t)i);
 154         extra += i;
 155 --- 5610,5618 ----
 156         if (s == NULL)
 157             break;
 158         if (extra)
 159             mch_memmove(s, y_ptr->y_array[lnum], (size_t)extra);
 160 +       if (append)
 161             vim_free(y_ptr->y_array[lnum]);
 162         if (i)
 163             mch_memmove(s + extra, str + start, (size_t)i);
 164         extra += i;
 165 *** ../vim-6.2.186/src/option.c Sun Oct 26 20:19:23 2003
 166 --- src/option.c        Thu Jan 15 22:03:06 2004
 167 ***************
 168 *** 7008,7013 ****
 169 --- 7008,7014 ----
 170       else
 171       {
 172         --arg;                      /* put arg at the '<' */
 173 +       modifiers = 0;
 174         key = find_special_key(&arg, &modifiers, TRUE);
 175         if (modifiers)              /* can't handle modifiers here */
 176             key = 0;
 177 *** ../vim-6.2.186/src/tag.c    Mon Dec 29 19:48:35 2003
 178 --- src/tag.c   Sun Jan 18 13:05:42 2004
 179 ***************
 180 *** 1066,1071 ****
 181 --- 1066,1076 ----
 182       int               is_etag;                /* current file is emaces style */
 183   #endif
 184
 185 +     struct match_found
 186 +     {
 187 +       int     len;            /* nr of chars of match[] to be compared */
 188 +       char_u  match[1];       /* actually longer */
 189 +     } *mfp, *mfp2;
 190       garray_T  ga_match[MT_COUNT];
 191       int               match_count = 0;                /* number of matches found */
 192       char_u    **matches;
 193 ***************
 194 *** 1110,1116 ****
 195       ebuf = alloc(LSIZE);
 196   #endif
 197       for (mtt = 0; mtt < MT_COUNT; ++mtt)
 198 !       ga_init2(&ga_match[mtt], (int)sizeof(char_u *), 100);
 199
 200       /* check for out of memory situation */
 201       if (lbuf == NULL || tag_fname == NULL
 202 --- 1115,1121 ----
 203       ebuf = alloc(LSIZE);
 204   #endif
 205       for (mtt = 0; mtt < MT_COUNT; ++mtt)
 206 !       ga_init2(&ga_match[mtt], (int)sizeof(struct match_found *), 100);
 207
 208       /* check for out of memory situation */
 209       if (lbuf == NULL || tag_fname == NULL
 210 ***************
 211 *** 1726,1738 ****
 212                 cc = *tagp.tagname_end;
 213                 *tagp.tagname_end = NUL;
 214                 match = vim_regexec(&regmatch, tagp.tagname, (colnr_T)0);
 215 !               matchoff = (int)(regmatch.startp[0] - tagp.tagname);
 216 !               if (match && regmatch.rm_ic)
 217                 {
 218 !                   regmatch.rm_ic = FALSE;
 219 !                   match_no_ic = vim_regexec(&regmatch, tagp.tagname,
 220                                                                   (colnr_T)0);
 221 !                   regmatch.rm_ic = TRUE;
 222                 }
 223                 *tagp.tagname_end = cc;
 224                 match_re = TRUE;
 225 --- 1731,1746 ----
 226                 cc = *tagp.tagname_end;
 227                 *tagp.tagname_end = NUL;
 228                 match = vim_regexec(&regmatch, tagp.tagname, (colnr_T)0);
 229 !               if (match)
 230                 {
 231 !                   matchoff = (int)(regmatch.startp[0] - tagp.tagname);
 232 !                   if (regmatch.rm_ic)
 233 !                   {
 234 !                       regmatch.rm_ic = FALSE;
 235 !                       match_no_ic = vim_regexec(&regmatch, tagp.tagname,
 236                                                                   (colnr_T)0);
 237 !                       regmatch.rm_ic = TRUE;
 238 !                   }
 239                 }
 240                 *tagp.tagname_end = cc;
 241                 match_re = TRUE;
 242 ***************
 243 *** 1793,1798 ****
 244 --- 1801,1811 ----
 245                         mtt += MT_RE_OFF;
 246                 }
 247
 248 +               /*
 249 +                * Add the found match in ga_match[mtt], avoiding duplicates.
 250 +                * Store the info we need later, which depends on the kind of
 251 +                * tags we are dealing with.
 252 +                */
 253                 if (ga_grow(&ga_match[mtt], 1) == OK)
 254                 {
 255                     if (help_only)
 256 ***************
 257 *** 1803,1846 ****
 258                          */
 259                         *tagp.tagname_end = NUL;
 260                         len = (int)(tagp.tagname_end - tagp.tagname);
 261 !                       p = vim_strnsave(tagp.tagname, len + 10);
 262 !                       if (p != NULL)
 263                             sprintf((char *)p + len + 1, "%06d",
 264                                     help_heuristic(tagp.tagname,
 265                                     match_re ? matchoff : 0, !match_no_ic));
 266                         *tagp.tagname_end = TAB;
 267 -                       ++len;  /* compare one more char */
 268                     }
 269                     else if (name_only)
 270                     {
 271 -                       p = NULL;
 272 -                       len = 0;
 273                         if (get_it_again)
 274                         {
 275                             char_u *temp_end = tagp.command;
 276
 277 !                           if ((*temp_end) == '/')
 278 !                               while ( *temp_end && (*temp_end != '\r')
 279 !                                       && (*temp_end != '\n')
 280 !                                       && (*temp_end != '$'))
 281                                     temp_end++;
 282
 283 !                           if ((tagp.command + 2) < temp_end)
 284                             {
 285                                 len = (int)(temp_end - tagp.command - 2);
 286 !                               p = vim_strnsave(tagp.command + 2, len);
 287                             }
 288                             get_it_again = FALSE;
 289                         }
 290                         else
 291                         {
 292                             len = (int)(tagp.tagname_end - tagp.tagname);
 293 !                           p = vim_strnsave(tagp.tagname, len);
 294 !                           /* if wanted, re-read line to get long form too*/
 295                             if (State & INSERT)
 296                                 get_it_again = p_sft;
 297                         }
 298 -                       ++len;  /* compare one more char */
 299                     }
 300                     else
 301                     {
 302 --- 1816,1880 ----
 303                          */
 304                         *tagp.tagname_end = NUL;
 305                         len = (int)(tagp.tagname_end - tagp.tagname);
 306 !                       mfp = (struct match_found *)
 307 !                                alloc(sizeof(struct match_found) + len + 10);
 308 !                       if (mfp != NULL)
 309 !                       {
 310 !                           mfp->len = len + 1; /* also compare the NUL */
 311 !                           p = mfp->match;
 312 !                           STRCPY(p, tagp.tagname);
 313                             sprintf((char *)p + len + 1, "%06d",
 314                                     help_heuristic(tagp.tagname,
 315                                     match_re ? matchoff : 0, !match_no_ic));
 316 +                       }
 317                         *tagp.tagname_end = TAB;
 318                     }
 319                     else if (name_only)
 320                     {
 321                         if (get_it_again)
 322                         {
 323                             char_u *temp_end = tagp.command;
 324
 325 !                           if (*temp_end == '/')
 326 !                               while (*temp_end && *temp_end != '\r'
 327 !                                       && *temp_end != '\n'
 328 !                                       && *temp_end != '$')
 329                                     temp_end++;
 330
 331 !                           if (tagp.command + 2 < temp_end)
 332                             {
 333                                 len = (int)(temp_end - tagp.command - 2);
 334 !                               mfp = (struct match_found *)
 335 !                                     alloc(sizeof(struct match_found) + len);
 336 !                               if (mfp != NULL)
 337 !                               {
 338 !                                   mfp->len = len + 1; /* include the NUL */
 339 !                                   p = mfp->match;
 340 !                                   STRNCPY(p, tagp.command + 2, len);
 341 !                                   p[len] = NUL;
 342 !                               }
 343                             }
 344 +                           else
 345 +                               mfp = NULL;
 346                             get_it_again = FALSE;
 347                         }
 348                         else
 349                         {
 350                             len = (int)(tagp.tagname_end - tagp.tagname);
 351 !                           mfp = (struct match_found *)
 352 !                                     alloc(sizeof(struct match_found) + len);
 353 !                           if (mfp != NULL)
 354 !                           {
 355 !                               mfp->len = len + 1; /* include the NUL */
 356 !                               p = mfp->match;
 357 !                               STRNCPY(p, tagp.tagname, len);
 358 !                               p[len] = NUL;
 359 !                           }
 360 !
 361 !                           /* if wanted, re-read line to get long form too */
 362                             if (State & INSERT)
 363                                 get_it_again = p_sft;
 364                         }
 365                     }
 366                     else
 367                     {
 368 ***************
 369 *** 1856,1864 ****
 370                         else
 371                             ++len;
 372   #endif
 373 !                       p = alloc(len);
 374 !                       if (p != NULL)
 375                         {
 376                             p[0] = mtt;
 377                             STRCPY(p + 1, tag_fname);
 378   #ifdef BACKSLASH_IN_FILENAME
 379 --- 1890,1901 ----
 380                         else
 381                             ++len;
 382   #endif
 383 !                       mfp = (struct match_found *)
 384 !                                     alloc(sizeof(struct match_found) + len);
 385 !                       if (mfp != NULL)
 386                         {
 387 +                           mfp->len = len;
 388 +                           p = mfp->match;
 389                             p[0] = mtt;
 390                             STRCPY(p + 1, tag_fname);
 391   #ifdef BACKSLASH_IN_FILENAME
 392 ***************
 393 *** 1880,1886 ****
 394                         }
 395                     }
 396
 397 !                   if (p != NULL)
 398                     {
 399                         /*
 400                          * Don't add identical matches.
 401 --- 1917,1923 ----
 402                         }
 403                     }
 404
 405 !                   if (mfp != NULL)
 406                     {
 407                         /*
 408                          * Don't add identical matches.
 409 ***************
 410 *** 1895,1915 ****
 411   #endif
 412                           for (i = ga_match[mtt].ga_len; --i >= 0 && !got_int; )
 413                           {
 414 !                           if (vim_memcmp(
 415 !                                     ((char_u **)(ga_match[mtt].ga_data))[i],
 416 !                                                        p, (size_t)len) == 0)
 417 !                               break;
 418 !                           line_breakcheck();
 419                           }
 420                         if (i < 0)
 421                         {
 422 !                           ((char_u **)(ga_match[mtt].ga_data))
 423 !                                                [ga_match[mtt].ga_len++] = p;
 424                             ga_match[mtt].ga_room--;
 425                             ++match_count;
 426                         }
 427                         else
 428 !                           vim_free(p);
 429                     }
 430                 }
 431                 else    /* Out of memory! Just forget about the rest. */
 432 --- 1932,1954 ----
 433   #endif
 434                           for (i = ga_match[mtt].ga_len; --i >= 0 && !got_int; )
 435                           {
 436 !                             mfp2 = ((struct match_found **)
 437 !                                                 (ga_match[mtt].ga_data))[i];
 438 !                             if (mfp2->len == mfp->len
 439 !                                     && vim_memcmp(mfp2->match, mfp->match,
 440 !                                                      (size_t)mfp->len) == 0)
 441 !                                 break;
 442 !                             line_breakcheck();
 443                           }
 444                         if (i < 0)
 445                         {
 446 !                           ((struct match_found **)(ga_match[mtt].ga_data))
 447 !                                              [ga_match[mtt].ga_len++] = mfp;
 448                             ga_match[mtt].ga_room--;
 449                             ++match_count;
 450                         }
 451                         else
 452 !                           vim_free(mfp);
 453                     }
 454                 }
 455                 else    /* Out of memory! Just forget about the rest. */
 456 ***************
 457 *** 2021,2031 ****
 458       {
 459         for (i = 0; i < ga_match[mtt].ga_len; ++i)
 460         {
 461 !           p = ((char_u **)(ga_match[mtt].ga_data))[i];
 462             if (matches == NULL)
 463 !               vim_free(p);
 464             else
 465 !               matches[match_count++] = p;
 466         }
 467         ga_clear(&ga_match[mtt]);
 468       }
 469 --- 2060,2077 ----
 470       {
 471         for (i = 0; i < ga_match[mtt].ga_len; ++i)
 472         {
 473 !           mfp = ((struct match_found **)(ga_match[mtt].ga_data))[i];
 474             if (matches == NULL)
 475 !               vim_free(mfp);
 476             else
 477 !           {
 478 !               /* To avoid allocating memory again we turn the struct
 479 !                * match_found into a string.  For help the priority was not
 480 !                * included in the length. */
 481 !               mch_memmove(mfp, mfp->match,
 482 !                                  (size_t)(mfp->len + (help_only ? 9 : 0)));
 483 !               matches[match_count++] = (char_u *)mfp;
 484 !           }
 485         }
 486         ga_clear(&ga_match[mtt]);
 487       }
 488 *** ../vim-6.2.186/src/ui.c     Sat Sep 27 19:36:47 2003
 489 --- src/ui.c    Thu Jan 15 22:16:00 2004
 490 ***************
 491 *** 1539,1544 ****
 492 --- 1539,1545 ----
 493
 494   /*
 495    * Restore the input buffer with a pointer returned from get_input_buf().
 496 +  * The allocated memory is freed, this only works once!
 497    */
 498       void
 499   set_input_buf(p)
 500 ***************
 501 *** 1546,1555 ****
 502   {
 503       garray_T  *gap = (garray_T *)p;
 504
 505 !     if (gap != NULL && gap->ga_data != NULL)
 506       {
 507 !       mch_memmove(inbuf, gap->ga_data, gap->ga_len);
 508 !       inbufcount = gap->ga_len;
 509       }
 510   }
 511   #endif
 512 --- 1547,1561 ----
 513   {
 514       garray_T  *gap = (garray_T *)p;
 515
 516 !     if (gap != NULL)
 517       {
 518 !       if (gap->ga_data != NULL)
 519 !       {
 520 !           mch_memmove(inbuf, gap->ga_data, gap->ga_len);
 521 !           inbufcount = gap->ga_len;
 522 !           vim_free(gap->ga_data);
 523 !       }
 524 !       vim_free(gap);
 525       }
 526   }
 527   #endif
 528 *** ../vim-6.2.186/src/version.c        Sun Jan 18 20:50:42 2004
 529 --- src/version.c       Sun Jan 18 20:52:09 2004
 530 ***************
 531 *** 639,640 ****
 532 --- 639,642 ----
 533   {   /* Add new patch number below this line */
 534 + /**/
 535 +     187,
 536   /**/
 537
 538 --
 539 ARTHUR:  I did say sorry about the `old woman,' but from the behind you
 540          looked--
 541 DENNIS:  What I object to is you automatically treat me like an inferior!
 542 ARTHUR:  Well, I AM king...
 543                                   The Quest for the Holy Grail (Monty Python)
 544
 545  /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
 546 ///        Sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
 547 \\\              Project leader for A-A-P -- http://www.A-A-P.org        ///
 548  \\\  Help AIDS victims, buy here: http://ICCF-Holland.org/click1.html  ///