diff --git a/7.1.087 b/7.1.087 new file mode 100644 index 0000000..3ba731e --- /dev/null +++ b/7.1.087 @@ -0,0 +1,151 @@ +To: vim-dev@vim.org +Subject: patch 7.1.087 +Fcc: outbox +From: Bram Moolenaar +Mime-Version: 1.0 +Content-Type: text/plain; charset=ISO-8859-1 +Content-Transfer-Encoding: 8bit +------------ + +Patch 7.1.087 +Problem: Reading past ":cscope find" command. Writing past end of a buffer. +Solution: Check length of the argument before using the pattern. Use + vim_strncpy(). (Dominique Pelle) +Files: if_cscope.c + + +*** ../vim-7.1.086/src/if_cscope.c Sun Mar 11 15:48:29 2007 +--- src/if_cscope.c Sun Aug 19 22:17:09 2007 +*************** +*** 73,78 **** +--- 73,80 ---- + + + static csinfo_T csinfo[CSCOPE_MAX_CONNECTIONS]; ++ static int eap_arg_len; /* length of eap->arg, set in ++ cs_lookup_cmd() */ + static cscmd_T cs_cmds[] = + { + { "add", cs_add, +*************** +*** 260,273 **** + + if ((p = cs_manage_matches(NULL, NULL, -1, Get)) == NULL) + return TRUE; +! +! if ((int)strlen(p) > size) +! { +! strncpy((char *)buf, p, size - 1); +! buf[size] = '\0'; +! } +! else +! (void)strcpy((char *)buf, p); + + return FALSE; + } /* cs_fgets */ +--- 262,268 ---- + + if ((p = cs_manage_matches(NULL, NULL, -1, Get)) == NULL) + return TRUE; +! vim_strncpy(buf, (char_u *)p, size - 1); + + return FALSE; + } /* cs_fgets */ +*************** +*** 386,392 **** + * PRIVATE: cs_add + * + * add cscope database or a directory name (to look for cscope.out) +! * the the cscope connection list + * + * MAXPATHL 256 + */ +--- 381,387 ---- + * PRIVATE: cs_add + * + * add cscope database or a directory name (to look for cscope.out) +! * to the cscope connection list + * + * MAXPATHL 256 + */ +*************** +*** 966,972 **** + } + + pat = opt + strlen(opt) + 1; +! if (pat == NULL || (pat != NULL && pat[0] == '\0')) + { + cs_usage_msg(Find); + return FALSE; +--- 961,967 ---- + } + + pat = opt + strlen(opt) + 1; +! if (pat >= (char *)eap->arg + eap_arg_len) + { + cs_usage_msg(Find); + return FALSE; +*************** +*** 1317,1323 **** + #else + /* compare pathnames first */ + && ((fullpathcmp(csinfo[j].fname, fname, FALSE) & FPC_SAME) +! /* if not Windows 9x, test index file atributes too */ + || (!mch_windows95() + && csinfo[j].nVolume == bhfi.dwVolumeSerialNumber + && csinfo[j].nIndexHigh == bhfi.nFileIndexHigh +--- 1312,1318 ---- + #else + /* compare pathnames first */ + && ((fullpathcmp(csinfo[j].fname, fname, FALSE) & FPC_SAME) +! /* if not Windows 9x, test index file attributes too */ + || (!mch_windows95() + && csinfo[j].nVolume == bhfi.dwVolumeSerialNumber + && csinfo[j].nIndexHigh == bhfi.nFileIndexHigh +*************** +*** 1401,1406 **** +--- 1396,1404 ---- + if (eap->arg == NULL) + return NULL; + ++ /* Store length of eap->arg before it gets modified by strtok(). */ ++ eap_arg_len = STRLEN(eap->arg); ++ + if ((stok = strtok((char *)(eap->arg), (const char *)" ")) == NULL) + return NULL; + +*************** +*** 2195,2201 **** + cs_add_common(dblist[i], pplist[i], fllist[i]); + if (p_csverbose) + { +! /* dont' use smsg_attr because want to display + * connection number in the same line as + * "Added cscope database..." + */ +--- 2193,2199 ---- + cs_add_common(dblist[i], pplist[i], fllist[i]); + if (p_csverbose) + { +! /* don't use smsg_attr() because we want to display the + * connection number in the same line as + * "Added cscope database..." + */ +*** ../vim-7.1.086/src/version.c Tue Aug 21 17:29:04 2007 +--- src/version.c Tue Aug 21 17:59:42 2007 +*************** +*** 668,669 **** +--- 668,671 ---- + { /* Add new patch number below this line */ ++ /**/ ++ 87, + /**/ + +-- +hundred-and-one symptoms of being an internet addict: +223. You set up a web-cam as your home's security system. + + /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ +/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\ +\\\ download, build and distribute -- http://www.A-A-P.org /// + \\\ help me help AIDS victims -- http://ICCF-Holland.org /// diff --git a/README.patches b/README.patches index 2219a41..d3eafb1 100644 --- a/README.patches +++ b/README.patches @@ -101,4 +101,13 @@ Individual patches for Vim 7.1: 5259 7.1.074 crash when using string() on a recursively nested List 1686 7.1.075 ":let v:statusmsg" reads memory already freed 2376 7.1.076 a couple more strcpy() with overlapping arguments - 1551 7.1.077 flag indicating spell checking is to be done isn't always set + 2678 7.1.078 dropping file name on gvim containing CSI byte doesn't work + 2922 7.1.079 "@" character in 'isfname' doesn't pick up umlauts for latin1 + 2960 7.1.080 (extra) Compiler warnings for gvimex.cpp + 3253 7.1.081 completion doesn't work after ":!cat 7.1.87-1 +- patchlevel 87 + * Wed Aug 15 2007 Karsten Hopp 7.1.77-1 - patchlevel 77