Blame SOURCES/vim-7.4-CVE-2016-1248.patch

8b9a1c
diff -urN vim74_orig/src/option.c vim74/src/option.c
8b9a1c
--- vim74_orig/src/option.c	2016-12-12 12:18:52.614342651 +0100
8b9a1c
+++ vim74/src/option.c	2016-12-12 12:34:08.192983990 +0100
8b9a1c
@@ -5663,6 +5663,21 @@
8b9a1c
     return r;
8b9a1c
 }
8b9a1c
 
8b9a1c
+ /*
8b9a1c
+ * Return TRUE if "val" is a valid 'filetype' name.
8b9a1c
+ * Also used for 'syntax' and 'keymap'.
8b9a1c
+ */
8b9a1c
+    static int
8b9a1c
+valid_filetype(char_u *val)
8b9a1c
+{
8b9a1c
+    char_u *s;
8b9a1c
+
8b9a1c
+    for (s = val; *s != NUL; ++s)
8b9a1c
+   if (!ASCII_ISALNUM(*s) && vim_strchr((char_u *)".-_", *s) == NULL)
8b9a1c
+       return FALSE;
8b9a1c
+    return TRUE;
8b9a1c
+}
8b9a1c
+
8b9a1c
 /*
8b9a1c
  * Handle string options that need some action to perform when changed.
8b9a1c
  * Returns NULL for success, or an error message for an error.
8b9a1c
@@ -6054,8 +6069,11 @@
8b9a1c
 #ifdef FEAT_KEYMAP
8b9a1c
     else if (varp == &curbuf->b_p_keymap)
8b9a1c
     {
8b9a1c
-	/* load or unload key mapping tables */
8b9a1c
-	errmsg = keymap_init();
8b9a1c
+        if (!valid_filetype(*varp))
8b9a1c
+            errmsg = e_invarg;
8b9a1c
+        else
8b9a1c
+            /* load or unload key mapping tables */
8b9a1c
+            errmsg = keymap_init();	
8b9a1c
 
8b9a1c
 	if (errmsg == NULL)
8b9a1c
 	{
8b9a1c
@@ -7010,6 +7028,23 @@
8b9a1c
     }
8b9a1c
 #endif
8b9a1c
 
8b9a1c
+#ifdef FEAT_AUTOCMD
8b9a1c
+    else if (gvarp == &p_ft)
8b9a1c
+    {
8b9a1c
+   if (!valid_filetype(*varp))
8b9a1c
+       errmsg = e_invarg;
8b9a1c
+    }
8b9a1c
+#endif
8b9a1c
+
8b9a1c
+#ifdef FEAT_SYN_HL
8b9a1c
+    else if (gvarp == &p_syn)
8b9a1c
+    {
8b9a1c
+   if (!valid_filetype(*varp))
8b9a1c
+       errmsg = e_invarg;
8b9a1c
+    }
8b9a1c
+#endif
8b9a1c
+
8b9a1c
+
8b9a1c
     /* Options that are a list of flags. */
8b9a1c
     else
8b9a1c
     {