Merge pull request #17231 from seandewar/vim-8.2.4245

vim-patch:8.2.4245: ":retab 0" may cause illegal memory access

1 files changed, 9 insertions, 18 deletions

diff --git a/src/nvim/option.c b/src/nvim/option.c
index 2fb1966cda..80dde2eda6 100644
--- a/src/nvim/option.c
+++ b/src/nvim/option.c
@@ -3178,10 +3178,7 @@ ambw_end:
     char_u *cp;
 
     if (!(*varp)[0] || ((*varp)[0] == '0' && !(*varp)[1])) {
-      if (curbuf->b_p_vsts_array) {
-        xfree(curbuf->b_p_vsts_array);
-        curbuf->b_p_vsts_array = 0;
-      }
+      XFREE_CLEAR(curbuf->b_p_vsts_array);
     } else {
       for (cp = *varp; *cp; cp++) {
         if (ascii_isdigit(*cp)) {
@@ -3206,10 +3203,7 @@ ambw_end:
     char_u *cp;
 
     if (!(*varp)[0] || ((*varp)[0] == '0' && !(*varp)[1])) {
-      if (curbuf->b_p_vts_array) {
-        xfree(curbuf->b_p_vts_array);
-        curbuf->b_p_vts_array = NULL;
-      }
+      XFREE_CLEAR(curbuf->b_p_vts_array);
     } else {
       for (cp = *varp; *cp; cp++) {
         if (ascii_isdigit(*cp)) {
@@ -4420,6 +4414,8 @@ static char *set_num_option(int opt_idx, char_u *varp, long value, char *errbuf,
   } else if (pp == &curbuf->b_p_ts || pp == &p_ts) {
     if (value < 1) {
       errmsg = e_positive;
+    } else if (value > TABSTOP_MAX) {
+      errmsg = e_invarg;
     }
   } else if (pp == &curbuf->b_p_tw || pp == &p_tw) {
     if (value < 0) {
@@ -6416,7 +6412,7 @@ void buf_copy_options(buf_T *buf, int flags)
       if (p_vsts && p_vsts != empty_option) {
         (void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
       } else {
-        buf->b_p_vsts_array = 0;
+        buf->b_p_vsts_array = NULL;
       }
       buf->b_p_vsts_nopaste = p_vsts_nopaste
                                 ? vim_strsave(p_vsts_nopaste)
@@ -7153,10 +7149,7 @@ static void paste_option_changed(void)
         free_string_option(buf->b_p_vsts);
       }
       buf->b_p_vsts = empty_option;
-      if (buf->b_p_vsts_array) {
-        xfree(buf->b_p_vsts_array);
-      }
-      buf->b_p_vsts_array = 0;
+      XFREE_CLEAR(buf->b_p_vsts_array);
     }
 
     // set global options
@@ -7193,13 +7186,11 @@ static void paste_option_changed(void)
       buf->b_p_vsts = buf->b_p_vsts_nopaste
                         ? vim_strsave(buf->b_p_vsts_nopaste)
                         : empty_option;
-      if (buf->b_p_vsts_array) {
-        xfree(buf->b_p_vsts_array);
-      }
+      xfree(buf->b_p_vsts_array);
       if (buf->b_p_vsts && buf->b_p_vsts != empty_option) {
         (void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
       } else {
-        buf->b_p_vsts_array = 0;
+        buf->b_p_vsts_array = NULL;
       }
     }
 
@@ -7560,7 +7551,7 @@ bool tabstop_set(char_u *var, long **array)
     int n = atoi((char *)cp);
 
     // Catch negative values, overflow and ridiculous big values.
-    if (n < 0 || n > 9999) {
+    if (n < 0 || n > TABSTOP_MAX) {
       semsg(_(e_invarg2), cp);
       XFREE_CLEAR(*array);
       return false;