To: vim_dev@googlegroups.com
Subject: Patch 7.4.624
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------
 
Patch 7.4.624
Problem:    May leak memory or crash when vim_realloc() returns NULL.
Solution:   Handle a NULL value properly. (Mike Williams)
Files:	    src/if_cscope.c, src/memline.c, src/misc1.c, src/netbeans.c
 
 
*** ../vim-7.4.623/src/if_cscope.c	2014-12-13 03:20:10.539067382 +0100
--- src/if_cscope.c	2015-02-10 18:33:14.764816257 +0100
***************
*** 1507,1515 ****
--- 1507,1522 ----
  	}
  	else
  	{
+ 	    csinfo_T *t_csinfo = csinfo;
+ 
  	    /* Reallocate space for more connections. */
  	    csinfo_size *= 2;
  	    csinfo = vim_realloc(csinfo, sizeof(csinfo_T)*csinfo_size);
+ 	    if (csinfo == NULL)
+ 	    {
+ 		vim_free(t_csinfo);
+ 		csinfo_size = 0;
+ 	    }
  	}
  	if (csinfo == NULL)
  	    return -1;
***************
*** 2059,2064 ****
--- 2066,2072 ----
      int num_matches;
  {
      char	*buf = NULL;
+     char	*t_buf;
      int		bufsize = 0; /* Track available bufsize */
      int		newsize = 0;
      char	*ptag;
***************
*** 2120,2128 ****
--- 2128,2140 ----
  	newsize = (int)(strlen(csfmt_str) + 16 + strlen(lno));
  	if (bufsize < newsize)
  	{
+ 	    t_buf = buf;
  	    buf = (char *)vim_realloc(buf, newsize);
  	    if (buf == NULL)
+ 	    {
  		bufsize = 0;
+ 		vim_free(t_buf);
+ 	    }
  	    else
  		bufsize = newsize;
  	}
***************
*** 2143,2151 ****
--- 2155,2167 ----
  
  	if (bufsize < newsize)
  	{
+ 	    t_buf = buf;
  	    buf = (char *)vim_realloc(buf, newsize);
  	    if (buf == NULL)
+ 	    {
  		bufsize = 0;
+ 		vim_free(t_buf);
+ 	    }
  	    else
  		bufsize = newsize;
  	}
*** ../vim-7.4.623/src/memline.c	2014-08-13 21:58:24.824885492 +0200
--- src/memline.c	2015-02-10 18:26:23.158126542 +0100
***************
*** 5057,5062 ****
--- 5057,5064 ----
  	/* May resize here so we don't have to do it in both cases below */
  	if (buf->b_ml.ml_usedchunks + 1 >= buf->b_ml.ml_numchunks)
  	{
+ 	    chunksize_T *t_chunksize = buf->b_ml.ml_chunksize;
+ 
  	    buf->b_ml.ml_numchunks = buf->b_ml.ml_numchunks * 3 / 2;
  	    buf->b_ml.ml_chunksize = (chunksize_T *)
  		vim_realloc(buf->b_ml.ml_chunksize,
***************
*** 5064,5069 ****
--- 5066,5072 ----
  	    if (buf->b_ml.ml_chunksize == NULL)
  	    {
  		/* Hmmmm, Give up on offset for this buffer */
+ 		vim_free(t_chunksize);
  		buf->b_ml.ml_usedchunks = -1;
  		return;
  	    }
*** ../vim-7.4.623/src/misc1.c	2014-08-29 12:58:38.246430208 +0200
--- src/misc1.c	2015-02-10 18:26:35.405968505 +0100
***************
*** 3431,3440 ****
--- 3431,3444 ----
  	    buf = alloc(buflen);
  	else if (maxlen < 10)
  	{
+ 	    char_u  *t_buf = buf;
+ 
  	    /* Need some more space. This might happen when receiving a long
  	     * escape sequence. */
  	    buflen += 100;
  	    buf = vim_realloc(buf, buflen);
+ 	    if (buf == NULL)
+ 		vim_free(t_buf);
  	    maxlen = (buflen - 6 - len) / 3;
  	}
  	if (buf == NULL)
*** ../vim-7.4.623/src/netbeans.c	2014-03-23 15:12:29.927264336 +0100
--- src/netbeans.c	2015-02-10 18:27:18.693409965 +0100
***************
*** 1080,1089 ****
--- 1080,1097 ----
      {
  	if (bufno >= buf_list_size) /* grow list */
  	{
+ 	    nbbuf_T *t_buf_list = buf_list;
+ 
  	    incr = bufno - buf_list_size + 90;
  	    buf_list_size += incr;
  	    buf_list = (nbbuf_T *)vim_realloc(
  				   buf_list, buf_list_size * sizeof(nbbuf_T));
+ 	    if (buf_list == NULL)
+ 	    {
+ 		vim_free(t_buf_list);
+ 		buf_list_size = 0;
+ 		return NULL;
+ 	    }
  	    vim_memset(buf_list + buf_list_size - incr, 0,
  						      incr * sizeof(nbbuf_T));
  	}
***************
*** 3678,3688 ****
--- 3686,3703 ----
  	    {
  		int incr;
  		int oldlen = globalsignmaplen;
+ 		char **t_globalsignmap = globalsignmap;
  
  		globalsignmaplen *= 2;
  		incr = globalsignmaplen - oldlen;
  		globalsignmap = (char **)vim_realloc(globalsignmap,
  					   globalsignmaplen * sizeof(char *));
+ 		if (globalsignmap == NULL)
+ 		{
+ 		    vim_free(t_globalsignmap);
+ 		    globalsignmaplen = 0;
+ 		    return;
+ 		}
  		vim_memset(globalsignmap + oldlen, 0, incr * sizeof(char *));
  	    }
  	}
***************
*** 3708,3718 ****
--- 3723,3740 ----
  	{
  	    int incr;
  	    int oldlen = buf->signmaplen;
+ 	    int *t_signmap = buf->signmap;
  
  	    buf->signmaplen *= 2;
  	    incr = buf->signmaplen - oldlen;
  	    buf->signmap = (int *)vim_realloc(buf->signmap,
  					       buf->signmaplen * sizeof(int));
+ 	    if (buf->signmap == NULL)
+ 	    {
+ 		vim_free(t_signmap);
+ 		buf->signmaplen = 0;
+ 		return;
+ 	    }
  	    vim_memset(buf->signmap + oldlen, 0, incr * sizeof(int));
  	}
      }
*** ../vim-7.4.623/src/version.c	2015-02-10 18:18:13.004452406 +0100
--- src/version.c	2015-02-10 18:21:29.697913596 +0100
***************
*** 743,744 ****
--- 743,746 ----
  {   /* Add new patch number below this line */
+ /**/
+     624,
  /**/
 
-- 
hundred-and-one symptoms of being an internet addict:
211. Your husband leaves you...taking the computer with him and you
     call him crying, and beg him to bring the computer back.
 
 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///