diff options
| author | Florian Larysch <fl@n621.de> | 2016-10-08 17:55:55 +0200 |
|---|---|---|
| committer | Justin M. Keyes <justinkz@gmail.com> | 2016-10-26 13:05:25 +0200 |
| commit | 2a6c5bb0c4b03a9da81dae64d37c9912e448eaf0 (patch) | |
| tree | 0fd9119bf18da9f765ae85b01747a853f2f8906b /src/nvim/buffer.c | |
| parent | 0f32088ea23fbbe9557c89a9e075f2e9b9e158a4 (diff) | |
| download | rneovim-2a6c5bb0c4b03a9da81dae64d37c9912e448eaf0.tar.gz rneovim-2a6c5bb0c4b03a9da81dae64d37c9912e448eaf0.tar.bz2 rneovim-2a6c5bb0c4b03a9da81dae64d37c9912e448eaf0.zip | |
modeline: Handle version number overflow. #5450
Closes #5449
A file containing the string "vim" followed by a very large number in a modeline
location will trigger an overflow in getdigits() which is called by
chk_modeline() when trying to parse the version number.
Add getdigits_safe(), which does not assert overflows, but reports them to the
caller.
Diffstat (limited to 'src/nvim/buffer.c')
| -rw-r--r-- | src/nvim/buffer.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c index 5fb011885e..a573c20648 100644 --- a/src/nvim/buffer.c +++ b/src/nvim/buffer.c @@ -4509,7 +4509,7 @@ chk_modeline ( char_u *e; char_u *linecopy; /* local copy of any modeline found */ int prev; - int vers; + intmax_t vers; int end; int retval = OK; char_u *save_sourcing_name; @@ -4528,7 +4528,10 @@ chk_modeline ( e = s + 4; else e = s + 3; - vers = getdigits_int(&e); + if (getdigits_safe(&e, &vers) != OK) { + continue; + } + if (*e == ':' && (s[0] != 'V' || STRNCMP(skipwhite(e + 1), "set", 3) == 0) @@ -4536,8 +4539,9 @@ chk_modeline ( || (VIM_VERSION_100 >= vers && isdigit(s[3])) || (VIM_VERSION_100 < vers && s[3] == '<') || (VIM_VERSION_100 > vers && s[3] == '>') - || (VIM_VERSION_100 == vers && s[3] == '='))) + || (VIM_VERSION_100 == vers && s[3] == '='))) { break; + } } } prev = *s; |