To: vim_dev@googlegroups.com
Subject: Patch 7.3.664
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------
 
Patch 7.3.664
Problem:    Buffer overflow in unescaping text. (Raymond Ko)
Solution:   Limit check for multi-byte character to 4 bytes.
Files:	    src/mbyte.c
 
 
*** ../vim-7.3.663/src/mbyte.c	2012-06-01 17:46:52.000000000 +0200
--- src/mbyte.c	2012-09-18 17:53:05.000000000 +0200
***************
*** 3793,3805 ****
  mb_unescape(pp)
      char_u **pp;
  {
!     static char_u	buf[MB_MAXBYTES + 1];
!     int			n, m = 0;
      char_u		*str = *pp;
  
      /* Must translate K_SPECIAL KS_SPECIAL KE_FILLER to K_SPECIAL and CSI
!      * KS_EXTRA KE_CSI to CSI. */
!     for (n = 0; str[n] != NUL && m <= MB_MAXBYTES; ++n)
      {
  	if (str[n] == K_SPECIAL
  		&& str[n + 1] == KS_SPECIAL
--- 3793,3807 ----
  mb_unescape(pp)
      char_u **pp;
  {
!     static char_u	buf[6];
!     int			n;
!     int			m = 0;
      char_u		*str = *pp;
  
      /* Must translate K_SPECIAL KS_SPECIAL KE_FILLER to K_SPECIAL and CSI
!      * KS_EXTRA KE_CSI to CSI.
!      * Maximum length of a utf-8 character is 4 bytes. */
!     for (n = 0; str[n] != NUL && m < 4; ++n)
      {
  	if (str[n] == K_SPECIAL
  		&& str[n + 1] == KS_SPECIAL
***************
*** 3836,3841 ****
--- 3838,3847 ----
  	    *pp = str + n + 1;
  	    return buf;
  	}
+ 
+ 	/* Bail out quickly for ASCII. */
+ 	if (buf[0] < 128)
+ 	    break;
      }
      return NULL;
  }
*** ../vim-7.3.663/src/version.c	2012-09-18 16:47:00.000000000 +0200
--- src/version.c	2012-09-18 18:01:14.000000000 +0200
***************
*** 721,722 ****
--- 721,724 ----
  {   /* Add new patch number below this line */
+ /**/
+     664,
  /**/
 
-- 
There are three kinds of people: Those who can count & those who can't.
 
 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///