To: vim-dev@vim.org

Subject: patch 7.1.020

Fcc: outbox

From: Bram Moolenaar <Bram@moolenaar.net>

Mime-Version: 1.0

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 8bit

------------

Patch 7.1.020

Problem:    Reading from uninitialized memory when using a dialog. (Dominique

	    Pelle)

Solution:   In msg_show_console_dialog() append a NUL after every appended

	    character.

Files:	    src/message.c

*** ../vim-7.1.019/src/message.c	Thu May 10 18:49:39 2007

--- src/message.c	Sun Jul  1 12:06:52 2007

***************

*** 3456,3466 ****

  		    /* advance to next hotkey and set default hotkey */

  #ifdef FEAT_MBYTE

  		    if (has_mbyte)

! 			hotkp += (*mb_ptr2len)(hotkp);

  		    else

  #endif

  			++hotkp;

! 		    (void)copy_char(r + 1, hotkp, TRUE);

  		    if (dfltbutton)

  			--dfltbutton;

--- 3456,3466 ----

  		    /* advance to next hotkey and set default hotkey */

  #ifdef FEAT_MBYTE

  		    if (has_mbyte)

! 			hotkp += STRLEN(hotkp);

  		    else

  #endif

  			++hotkp;

! 		    hotkp[copy_char(r + 1, hotkp, TRUE)] = NUL;

  		    if (dfltbutton)

  			--dfltbutton;

***************

*** 3493,3499 ****

  			*msgp++ = (dfltbutton == 1) ? ']' : ')';

  			/* redefine hotkey */

! 			(void)copy_char(r, hotkp, TRUE);

  		    }

  		}

  		else

--- 3493,3499 ----

  			*msgp++ = (dfltbutton == 1) ? ']' : ')';

  			/* redefine hotkey */

! 			hotkp[copy_char(r, hotkp, TRUE)] = NUL;

  		    }

  		}

  		else

***************

*** 3519,3526 ****

  	    *msgp++ = ':';

  	    *msgp++ = ' ';

  	    *msgp = NUL;

- 	    mb_ptr_adv(hotkp);

- 	    *hotkp = NUL;

  	}

  	else

  	{

--- 3519,3524 ----

***************

*** 3555,3562 ****

  	    msgp = confirm_msg + 1 + STRLEN(message);

  	    hotkp = hotk;

! 	    /* define first default hotkey */

! 	    (void)copy_char(buttons, hotkp, TRUE);

  	    /* Remember where the choices start, displaying starts here when

  	     * "hotkp" typed at the more prompt. */

--- 3553,3561 ----

  	    msgp = confirm_msg + 1 + STRLEN(message);

  	    hotkp = hotk;

! 	    /* Define first default hotkey.  Keep the hotkey string NUL

! 	     * terminated to avoid reading past the end. */

! 	    hotkp[copy_char(buttons, hotkp, TRUE)] = NUL;

  	    /* Remember where the choices start, displaying starts here when

  	     * "hotkp" typed at the more prompt. */

*** ../vim-7.1.019/src/version.c	Thu Jul  5 09:53:20 2007

--- src/version.c	Thu Jul  5 10:09:34 2007

***************

*** 668,669 ****

--- 668,671 ----

  {   /* Add new patch number below this line */

+ /**/

+     20,

  /**/

-- 

BLACK KNIGHT:  Come on you pansy!

    [hah] [parry thrust]

    [ARTHUR chops the BLACK KNIGHT's right arm off]

ARTHUR:        Victory is mine!  [kneeling]

               We thank thee Lord, that in thy merc-

    [Black Knight kicks Arthur in the head while he is praying]

                                  The Quest for the Holy Grail (Monty Python)

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\

///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\

\\\        download, build and distribute -- http://www.A-A-P.org        ///

 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///