[patch] fixed 2 bugs with 'colorcolum'

[Dominique Pellé]

Hi

Attached patch fixes 2 issues when setting up option 'colorcolumn'
in Vim-7.3a (2319:966a5609669e):

1/ trailing comma as in ":set cc=80,"  was not recognized as an error
2/ access to illegal memory when doing:

    $ valgrind vim -u NONE -c 'set cc=-1' 2> vg.log

    ==6060== Invalid read of size 1
    ==6060==    at 0x50B2FE: check_colorcolumn (option.c:6959)
    ==6060==    by 0x508CB1: did_set_string_option (option.c:5656)
    ==6060==    by 0x507400: do_set (option.c:4771)
    ==6060==    by 0x4771E0: ex_set (ex_docmd.c:11087)
    ==6060==    by 0x4690ED: do_one_cmd (ex_docmd.c:2646)
    ==6060==    by 0x466764: do_cmdline (ex_docmd.c:1114)
    ==6060==    by 0x465F19: do_cmdline_cmd (ex_docmd.c:720)
    ==6060==    by 0x4AC9C8: exe_commands (main.c:2798)
    ==6060==    by 0x4A9FB0: main (main.c:884)
    ==6060==  Address 0xb46c5a3 is 0 bytes after a block of size 3 alloc'd
    ==6060==    at 0x4C241C3: malloc (vg_replace_malloc.c:195)
    ==6060==    by 0x4D8AA2: lalloc (misc2.c:919)
    ==6060==    by 0x4D89AF: alloc (misc2.c:818)
    ==6060==    by 0x506E38: do_set (option.c:4603)
    ==6060==    by 0x4771E0: ex_set (ex_docmd.c:11087)
    ==6060==    by 0x4690ED: do_one_cmd (ex_docmd.c:2646)
    ==6060==    by 0x466764: do_cmdline (ex_docmd.c:1114)
    ==6060==    by 0x465F19: do_cmdline_cmd (ex_docmd.c:720)
    ==6060==    by 0x4AC9C8: exe_commands (main.c:2798)
    ==6060==    by 0x4A9FB0: main (main.c:884)

Regards
-- Dominique

-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

diff -r 966a5609669e src/option.c
--- a/src/option.c	Wed Jul 14 23:23:17 2010 +0200
+++ b/src/option.c	Thu Jul 15 09:48:07 2010 +0200
@@ -6956,7 +6956,7 @@
     int		i;
     int		j = 0;
 
-    for (s = wp->w_p_cc; *s != NUL && count < 255; ++s)
+    for (s = wp->w_p_cc; *s != NUL && count < 255;)
     {
 	if (*s == '-' || *s == '+')
 	{
@@ -6967,21 +6967,23 @@
 		return e_invarg;
 	    col = col * getdigits(&s);
 	    if (wp->w_buffer->b_p_tw == 0)
-		continue;  /* 'textwidth' not set, skip this item */
+		goto skip;  /* 'textwidth' not set, skip this item */
 	    col += wp->w_buffer->b_p_tw;
 	    if (col < 0)
-		continue;
+		goto skip;
 	}
 	else if (VIM_ISDIGIT(*s))
 	    col = getdigits(&s);
 	else
 	    return e_invarg;
 	color_cols[count++] = col - 1;  /* 1-based to 0-based */
-
+skip:
 	if (*s == NUL)
 	    break;
 	if (*s != ',')
 	    return e_invarg;
+	if (*++s == NUL)
+	    return e_invarg;  /* illegal trailing comma as in "set cc=80," */
     }
 
     vim_free(wp->w_p_cc_cols);