7.2.157

   1 To: vim-dev@vim.org
   2 Subject: Patch 7.2.157
   3 Fcc: outbox
   4 From: Bram Moolenaar <Bram@moolenaar.net>
   5 Mime-Version: 1.0
   6 Content-Type: text/plain; charset=ISO-8859-1
   7 Content-Transfer-Encoding: 8bit
   8 ------------
   9
  10 Patch 7.2.157
  11 Problem:    Illegal memory access when searching in path.
  12 Solution:   Avoid looking at a byte after end of a string. (Dominique Pelle)
  13 Files:      src/search.c
  14
  15
  16 *** ../vim-7.2.156/src/search.c Fri Jul 18 12:05:58 2008
  17 --- src/search.c        Wed Apr 22 12:26:19 2009
  18 ***************
  19 *** 2327,2334 ****
  20                     for (col = pos.col; check_prevcol(linep, col, '\\', &col);)
  21                         bslcnt++;
  22                 }
  23 !               /* Only accept a match when 'M' is in 'cpo' or when ecaping is
  24 !                * what we expect. */
  25                 if (cpo_bsl || (bslcnt & 1) == match_escaped)
  26                 {
  27                     if (c == initc)
  28 --- 2336,2343 ----
  29                     for (col = pos.col; check_prevcol(linep, col, '\\', &col);)
  30                         bslcnt++;
  31                 }
  32 !               /* Only accept a match when 'M' is in 'cpo' or when escaping
  33 !                * is what we expect. */
  34                 if (cpo_bsl || (bslcnt & 1) == match_escaped)
  35                 {
  36                     if (c == initc)
  37 ***************
  38 *** 4663,4669 ****
  39                             msg_putchar('\n');      /* cursor below last one */
  40                             if (!got_int)           /* don't display if 'q'
  41                                                        typed at "--more--"
  42 !                                                      mesage */
  43                             {
  44                                 msg_home_replace_hl(new_fname);
  45                                 MSG_PUTS(_(" (includes previously listed match)"));
  46 --- 4672,4678 ----
  47                             msg_putchar('\n');      /* cursor below last one */
  48                             if (!got_int)           /* don't display if 'q'
  49                                                        typed at "--more--"
  50 !                                                      message */
  51                             {
  52                                 msg_home_replace_hl(new_fname);
  53                                 MSG_PUTS(_(" (includes previously listed match)"));
  54 ***************
  55 *** 4975,4981 ****
  56                                             || IObuff[i-2] == '!'))))
  57                                 IObuff[i++] = ' ';
  58                         }
  59 !                       /* copy as much as posible of the new word */
  60                         if (p - aux >= IOSIZE - i)
  61                             p = aux + IOSIZE - i - 1;
  62                         STRNCPY(IObuff + i, aux, p - aux);
  63 --- 4984,4990 ----
  64                                             || IObuff[i-2] == '!'))))
  65                                 IObuff[i++] = ' ';
  66                         }
  67 !                       /* copy as much as possible of the new word */
  68                         if (p - aux >= IOSIZE - i)
  69                             p = aux + IOSIZE - i - 1;
  70                         STRNCPY(IObuff + i, aux, p - aux);
  71 ***************
  72 *** 5010,5016 ****
  73                     if (did_show)
  74                         msg_putchar('\n');      /* cursor below last one */
  75                     if (!got_int)               /* don't display if 'q' typed
  76 !                                                   at "--more--" mesage */
  77                         msg_home_replace_hl(curr_fname);
  78                     prev_fname = curr_fname;
  79                 }
  80 --- 5019,5025 ----
  81                     if (did_show)
  82                         msg_putchar('\n');      /* cursor below last one */
  83                     if (!got_int)               /* don't display if 'q' typed
  84 !                                                   at "--more--" message */
  85                         msg_home_replace_hl(curr_fname);
  86                     prev_fname = curr_fname;
  87                 }
  88 ***************
  89 *** 5092,5098 ****
  90                 }
  91                 if (action != ACTION_SHOW)
  92                 {
  93 !                   curwin->w_cursor.col = (colnr_T) (startp - line);
  94                     curwin->w_set_curswant = TRUE;
  95                 }
  96
  97 --- 5101,5107 ----
  98                 }
  99                 if (action != ACTION_SHOW)
 100                 {
 101 !                   curwin->w_cursor.col = (colnr_T)(startp - line);
 102                     curwin->w_set_curswant = TRUE;
 103                 }
 104
 105 ***************
 106 *** 5119,5125 ****
 107                     && action == ACTION_EXPAND
 108                     && !(compl_cont_status & CONT_SOL)
 109   #endif
 110 !                   && *(p = startp + 1))
 111                 goto search_line;
 112         }
 113         line_breakcheck();
 114 --- 5128,5135 ----
 115                     && action == ACTION_EXPAND
 116                     && !(compl_cont_status & CONT_SOL)
 117   #endif
 118 !                   && *startp != NUL
 119 !                   && *(p = startp + 1) != NUL)
 120                 goto search_line;
 121         }
 122         line_breakcheck();
 123 *** ../vim-7.2.156/src/version.c        Wed Apr 22 16:22:44 2009
 124 --- src/version.c       Wed Apr 22 16:39:59 2009
 125 ***************
 126 *** 678,679 ****
 127 --- 678,681 ----
 128   {   /* Add new patch number below this line */
 129 + /**/
 130 +     157,
 131   /**/
 132
 133
 134 --
 135 ARTHUR:  Bloody peasant!
 136 DENNIS:  Oh, what a give away.  Did you hear that, did you hear that, eh?
 137          That's what I'm on about -- did you see him repressing me, you saw it
 138          didn't you?
 139                                   The Quest for the Holy Grail (Monty Python)
 140
 141  /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
 142 ///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
 143 \\\        download, build and distribute -- http://www.A-A-P.org        ///
 144  \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///