To: vim-dev@vim.org
Subject: patch 7.1.020
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
------------

Patch 7.1.020
Problem:    Reading from uninitialized memory when using a dialog. (Dominique
	    Pelle)
Solution:   In msg_show_console_dialog() append a NUL after every appended
	    character.
Files:	    src/message.c


*** ../vim-7.1.019/src/message.c	Thu May 10 18:49:39 2007
--- src/message.c	Sun Jul  1 12:06:52 2007
***************
*** 3456,3466 ****
  		    /* advance to next hotkey and set default hotkey */
  #ifdef FEAT_MBYTE
  		    if (has_mbyte)
! 			hotkp += (*mb_ptr2len)(hotkp);
  		    else
  #endif
  			++hotkp;
! 		    (void)copy_char(r + 1, hotkp, TRUE);
  		    if (dfltbutton)
  			--dfltbutton;
  
--- 3456,3466 ----
  		    /* advance to next hotkey and set default hotkey */
  #ifdef FEAT_MBYTE
  		    if (has_mbyte)
! 			hotkp += STRLEN(hotkp);
  		    else
  #endif
  			++hotkp;
! 		    hotkp[copy_char(r + 1, hotkp, TRUE)] = NUL;
  		    if (dfltbutton)
  			--dfltbutton;
  
***************
*** 3493,3499 ****
  			*msgp++ = (dfltbutton == 1) ? ']' : ')';
  
  			/* redefine hotkey */
! 			(void)copy_char(r, hotkp, TRUE);
  		    }
  		}
  		else
--- 3493,3499 ----
  			*msgp++ = (dfltbutton == 1) ? ']' : ')';
  
  			/* redefine hotkey */
! 			hotkp[copy_char(r, hotkp, TRUE)] = NUL;
  		    }
  		}
  		else
***************
*** 3519,3526 ****
  	    *msgp++ = ':';
  	    *msgp++ = ' ';
  	    *msgp = NUL;
- 	    mb_ptr_adv(hotkp);
- 	    *hotkp = NUL;
  	}
  	else
  	{
--- 3519,3524 ----
***************
*** 3555,3562 ****
  	    msgp = confirm_msg + 1 + STRLEN(message);
  	    hotkp = hotk;
  
! 	    /* define first default hotkey */
! 	    (void)copy_char(buttons, hotkp, TRUE);
  
  	    /* Remember where the choices start, displaying starts here when
  	     * "hotkp" typed at the more prompt. */
--- 3553,3561 ----
  	    msgp = confirm_msg + 1 + STRLEN(message);
  	    hotkp = hotk;
  
! 	    /* Define first default hotkey.  Keep the hotkey string NUL
! 	     * terminated to avoid reading past the end. */
! 	    hotkp[copy_char(buttons, hotkp, TRUE)] = NUL;
  
  	    /* Remember where the choices start, displaying starts here when
  	     * "hotkp" typed at the more prompt. */
*** ../vim-7.1.019/src/version.c	Thu Jul  5 09:53:20 2007
--- src/version.c	Thu Jul  5 10:09:34 2007
***************
*** 668,669 ****
--- 668,671 ----
  {   /* Add new patch number below this line */
+ /**/
+     20,
  /**/

-- 
BLACK KNIGHT:  Come on you pansy!
    [hah] [parry thrust]
    [ARTHUR chops the BLACK KNIGHT's right arm off]
ARTHUR:        Victory is mine!  [kneeling]
               We thank thee Lord, that in thy merc-
    [Black Knight kicks Arthur in the head while he is praying]
                                  The Quest for the Holy Grail (Monty Python)

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\        download, build and distribute -- http://www.A-A-P.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///