[patch] fixed access to uninitialized mem when using :wundo in unnamed buffer

[Dominique Pellé]

Hi

I see Valgrind errors in Vim-7.3a BETA (f8222d1f9a73) when using the
wundo command in an unnamed buffer:

$ valgrind --track-origins=yes vim -u NONE  -c 'wundo! foo' 2> vg.log

==4800== Syscall param stat64(file_name) points to unaddressable byte(s)
==4800==    at 0x499BC83: __xstat64@@GLIBC_2.2 (xstat64.c:50)
==4800==    by 0x81E4BDB: stat64 (in /home/pel/sb/vim/src/vim)
==4800==    by 0x81BBF38: u_write_undo (undo.c:1243)
==4800==    by 0x80AF8B8: ex_wundo (ex_docmd.c:8471)
==4800==    by 0x80A6DE4: do_one_cmd (ex_docmd.c:2639)
==4800==    by 0x80A46BD: do_cmdline (ex_docmd.c:1108)
==4800==    by 0x80A3D77: do_cmdline_cmd (ex_docmd.c:714)
==4800==    by 0x80E8FA8: exe_commands (main.c:2750)
==4800==    by 0x80E6785: main (main.c:880)
==4800==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==4800==
==4800== Conditional jump or move depends on uninitialised value(s)
==4800==    at 0x81BC0EE: u_write_undo (undo.c:1305)
==4800==    by 0x80AF8B8: ex_wundo (ex_docmd.c:8471)
==4800==    by 0x80A6DE4: do_one_cmd (ex_docmd.c:2639)
==4800==    by 0x80A46BD: do_cmdline (ex_docmd.c:1108)
==4800==    by 0x80A3D77: do_cmdline_cmd (ex_docmd.c:714)
==4800==    by 0x80E8FA8: exe_commands (main.c:2750)
==4800==    by 0x80E6785: main (main.c:880)
==4800==  Uninitialised value was created by a stack allocation
==4800==    at 0x81BBEDA: u_write_undo (undo.c:1219)
(more errors after that)

Attached patch fixes it.

-- Dominique

-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

diff -r f8222d1f9a73 src/undo.c
--- a/src/undo.c	Sun May 23 23:34:36 2010 +0200
+++ b/src/undo.c	Mon May 24 17:09:11 2010 +0200
@@ -1226,6 +1226,7 @@
     int		perm;
     int		write_ok = FALSE;
 #ifdef UNIX
+    int		st_old_valid = FALSE;
     struct stat	st_old;
     struct stat	st_new;
 #endif
@@ -1239,16 +1240,25 @@
     else
         file_name = name;
 
+    if (buf->b_ffname == NULL)
+	perm = 0600;
+    else
+    {
 #ifdef UNIX
-    if (mch_stat((char *)buf->b_ffname, &st_old) >= 0)
-	perm = st_old.st_mode;
-    else
-	perm = 0600;
+	if (mch_stat((char *)buf->b_ffname, &st_old) >= 0)
+	{
+	    perm = st_old.st_mode;
+	    st_old_valid = TRUE;
+	}
+	else
+	    perm = 0600;
 #else
-    perm = mch_getperm(buf->b_ffname);
-    if (perm < 0)
-	perm = 0600;
+	perm = mch_getperm(buf->b_ffname);
+	if (perm < 0)
+	    perm = 0600;
 #endif
+    }
+
     /* set file protection same as original file, but strip s-bit */
     perm = perm & 0777;
 
@@ -1302,15 +1312,17 @@
      * this fails, set the protection bits for the group same as the
      * protection bits for others.
      */
-    if (mch_stat((char *)file_name, &st_new) >= 0
-	    && st_new.st_gid != st_old.st_gid
+    if (!st_old_valid
+	|| (mch_stat((char *)file_name, &st_new) >= 0
+		&& st_new.st_gid != st_old.st_gid
 # ifdef HAVE_FCHOWN  /* sequent-ptx lacks fchown() */
-	    && fchown(fd, (uid_t)-1, st_old.st_gid) != 0
+		&& fchown(fd, (uid_t)-1, st_old.st_gid) != 0)
 # endif
        )
 	mch_setperm(file_name, (perm & 0707) | ((perm & 07) << 3));
 # ifdef HAVE_SELINUX
-    mch_copy_sec(buf->b_ffname, file_name);
+    if (buf->b_ffname != NULL)
+	mch_copy_sec(buf->b_ffname, file_name);
 # endif
 #endif
 
@@ -1431,9 +1443,11 @@
         EMSG2(_("E829: write error in undo file: %s"), file_name);
 
 #if defined(MACOS_CLASSIC) || defined(WIN3264)
-    (void)mch_copy_file_attribute(buf->b_ffname, file_name);
+    if (buf->b_ffname != NULL)
+	(void)mch_copy_file_attribute(buf->b_ffname, file_name);
 #endif
 #ifdef HAVE_ACL
+    if (buf->b_ffname != NULL)
     {
 	vim_acl_T	    acl;