To: vim-dev@vim.org

Subject: patch 7.1.032

Fcc: outbox

From: Bram Moolenaar <Bram@moolenaar.net>

Mime-Version: 1.0

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 8bit

------------

Patch 7.1.032

Problem:    Potential crash when editing a command line. (Chris Monson)

Solution:   Check the position to avoid access before the start of an array.

Files:	    src/ex_getln.c

*** ../vim-7.1.031/src/ex_getln.c	Thu May 10 20:22:29 2007

--- src/ex_getln.c	Tue Jul 17 18:05:49 2007

***************

*** 484,490 ****

  	if (xpc.xp_context == EXPAND_MENUNAMES && p_wmnu)

  	{

  	    /* Hitting <Down> after "emenu Name.": complete submenu */

! 	    if (ccline.cmdbuff[ccline.cmdpos - 1] == '.' && c == K_DOWN)

  		c = p_wc;

  	    else if (c == K_UP)

  	    {

--- 486,493 ----

  	if (xpc.xp_context == EXPAND_MENUNAMES && p_wmnu)

  	{

  	    /* Hitting <Down> after "emenu Name.": complete submenu */

! 	    if (c == K_DOWN && ccline.cmdpos > 0

! 				  && ccline.cmdbuff[ccline.cmdpos - 1] == '.')

  		c = p_wc;

  	    else if (c == K_UP)

  	    {

***************

*** 533,541 ****

  	    upseg[3] = PATHSEP;

  	    upseg[4] = NUL;

! 	    if (ccline.cmdbuff[ccline.cmdpos - 1] == PATHSEP

! 		    && c == K_DOWN

! 		    && (ccline.cmdbuff[ccline.cmdpos - 2] != '.'

  			|| ccline.cmdbuff[ccline.cmdpos - 3] != '.'))

  	    {

  		/* go down a directory */

--- 536,546 ----

  	    upseg[3] = PATHSEP;

  	    upseg[4] = NUL;

! 	    if (c == K_DOWN

! 		    && ccline.cmdpos > 0

! 		    && ccline.cmdbuff[ccline.cmdpos - 1] == PATHSEP

! 		    && (ccline.cmdpos < 3

! 			|| ccline.cmdbuff[ccline.cmdpos - 2] != '.'

  			|| ccline.cmdbuff[ccline.cmdpos - 3] != '.'))

  	    {

  		/* go down a directory */

***************

*** 730,737 ****

  	    /* In Ex mode a backslash escapes a newline. */

  	    if (exmode_active

  		    && c != ESC

- 		    && ccline.cmdpos > 0

  		    && ccline.cmdpos == ccline.cmdlen

  		    && ccline.cmdbuff[ccline.cmdpos - 1] == '\\')

  	    {

  		if (c == K_KENTER)

--- 735,742 ----

  	    /* In Ex mode a backslash escapes a newline. */

  	    if (exmode_active

  		    && c != ESC

  		    && ccline.cmdpos == ccline.cmdlen

+ 		    && ccline.cmdpos > 0

  		    && ccline.cmdbuff[ccline.cmdpos - 1] == '\\')

  	    {

  		if (c == K_KENTER)

*** ../vim-7.1.031/src/version.c	Tue Jul 17 16:31:15 2007

--- src/version.c	Tue Jul 17 18:10:37 2007

***************

*** 668,669 ****

--- 668,671 ----

  {   /* Add new patch number below this line */

+ /**/

+     32,

  /**/

-- 

ALL:   A witch!  A witch!

WITCH: It's a fair cop.

ALL:   Burn her!  Burn her!  Let's make her into a ladder.

                 "Monty Python and the Holy Grail" PYTHON (MONTY) PICTURES LTD

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\

///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\

\\\        download, build and distribute -- http://www.A-A-P.org        ///

 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///