From 44071fe77a168b26ed754d0799bbb51a58be923f Mon Sep 17 00:00:00 2001 From: KunMing Xie Date: Mon, 19 Feb 2018 04:55:39 +0800 Subject: vim-patch:8.0.0212: buffer for key name may be too small (#8009) Problem: The buffer used to store a key name theoreticaly could be too small. (Coverity) Solution: Count all possible modifier characters. Add a check for the length just in case. https://github.com/vim/vim/commit/423977d3cebac2be1158b1d11da60fe96db4b750 --- src/nvim/keymap.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) (limited to 'src/nvim/keymap.c') diff --git a/src/nvim/keymap.c b/src/nvim/keymap.c index eb0653c432..5e56e5f41b 100644 --- a/src/nvim/keymap.c +++ b/src/nvim/keymap.c @@ -40,6 +40,7 @@ static const struct modmasktable { // 'A' must be the last one { MOD_MASK_ALT, MOD_MASK_ALT, (char_u)'A' }, { 0, 0, NUL } + // NOTE: when adding an entry, update MAX_KEY_NAME_LEN! }; /* @@ -285,6 +286,7 @@ static const struct key_name_entry { { K_PLUG, "Plug" }, { K_PASTE, "Paste" }, { 0, NULL } + // NOTE: When adding a long name update MAX_KEY_NAME_LEN. }; static struct mousetable { @@ -472,9 +474,13 @@ char_u *get_special_key_name(int c, int modifiers) string[idx++] = *s++; } } - } else { /* use name of special key */ - STRCPY(string + idx, key_names_table[table_idx].name); - idx = (int)STRLEN(string); + } else { // use name of special key + size_t len = STRLEN(key_names_table[table_idx].name); + + if ((int)len + idx + 2 <= MAX_KEY_NAME_LEN) { + STRCPY(string + idx, key_names_table[table_idx].name); + idx += (int)len; + } } string[idx++] = '>'; string[idx] = NUL; -- cgit