Patch 7.3.160
Problem: Unsafe string copying.
Solution: Use vim_strncpy() instead of strcpy(). Use vim_strcat() instead
of strcat().
Files: src/buffer.c, src/ex_docmd.c, src/hardcopy.c, src/menu.c,
src/misc1.c, src/misc2.c, src/proto/misc2.pro, src/netbeans.c,
src/os_unix.c, src/spell.c, src/syntax.c, src/tag.c
*** ../vim-7.3.159/src/buffer.c 2011-02-15 14:24:42.000000000 +0100
--- src/buffer.c 2011-04-11 16:08:38.000000000 +0200
***************
*** 3176,3182 ****
/* format: "fname + (path) (1 of 2) - VIM" */
if (curbuf->b_fname == NULL)
! STRCPY(buf, _("[No Name]"));
else
{
p = transstr(gettail(curbuf->b_fname));
--- 3176,3182 ----
/* format: "fname + (path) (1 of 2) - VIM" */
if (curbuf->b_fname == NULL)
! vim_strncpy(buf, (char_u *)_("[No Name]"), IOSIZE - 100);
else
{
p = transstr(gettail(curbuf->b_fname));
***************
*** 3232,3238 ****
if (serverName != NULL)
{
STRCAT(buf, " - ");
! STRCAT(buf, serverName);
}
else
#endif
--- 3232,3238 ----
if (serverName != NULL)
{
STRCAT(buf, " - ");
! vim_strcat(buf, serverName, IOSIZE);
}
else
#endif
*** ../vim-7.3.159/src/ex_docmd.c 2011-03-03 15:54:45.000000000 +0100
--- src/ex_docmd.c 2011-04-11 15:43:48.000000000 +0200
***************
*** 5096,5102 ****
char_u buff[IOSIZE];
if (n == 1)
! STRCPY(buff, _("1 more file to edit. Quit anyway?"));
else
vim_snprintf((char *)buff, IOSIZE,
_("%d more files to edit. Quit anyway?"), n);
--- 5096,5104 ----
char_u buff[IOSIZE];
if (n == 1)
! vim_strncpy(buff,
! (char_u *)_("1 more file to edit. Quit anyway?"),
! IOSIZE - 1);
else
vim_snprintf((char *)buff, IOSIZE,
_("%d more files to edit. Quit anyway?"), n);
*** ../vim-7.3.159/src/hardcopy.c 2010-08-15 21:57:25.000000000 +0200
--- src/hardcopy.c 2011-04-11 15:30:09.000000000 +0200
***************
*** 1761,1772 ****
{
char_u buffer[MAXPATHL + 1];
! STRCPY(resource->name, name);
/* Look for named resource file in runtimepath */
STRCPY(buffer, "print");
add_pathsep(buffer);
! STRCAT(buffer, name);
! STRCAT(buffer, ".ps");
resource->filename[0] = NUL;
return (do_in_runtimepath(buffer, FALSE, prt_resource_name,
resource->filename)
--- 1761,1772 ----
{
char_u buffer[MAXPATHL + 1];
! vim_strncpy(resource->name, (char_u *)name, 63);
/* Look for named resource file in runtimepath */
STRCPY(buffer, "print");
add_pathsep(buffer);
! vim_strcat(buffer, (char_u *)name, MAXPATHL);
! vim_strcat(buffer, (char_u *)".ps", MAXPATHL);
resource->filename[0] = NUL;
return (do_in_runtimepath(buffer, FALSE, prt_resource_name,
resource->filename)
*** ../vim-7.3.159/src/menu.c 2011-01-04 17:49:25.000000000 +0100
--- src/menu.c 2011-04-11 15:17:21.000000000 +0200
***************
*** 1394,1400 ****
int idx;
{
static vimmenu_T *menu = NULL;
! static char_u tbuffer[256]; /*hack*/
char_u *str;
#ifdef FEAT_MULTI_LANG
static int should_advance = FALSE;
--- 1394,1401 ----
int idx;
{
static vimmenu_T *menu = NULL;
! #define TBUFFER_LEN 256
! static char_u tbuffer[TBUFFER_LEN]; /*hack*/
char_u *str;
#ifdef FEAT_MULTI_LANG
static int should_advance = FALSE;
***************
*** 1428,1438 ****
{
#ifdef FEAT_MULTI_LANG
if (should_advance)
! STRCPY(tbuffer, menu->en_dname);
else
{
#endif
! STRCPY(tbuffer, menu->dname);
#ifdef FEAT_MULTI_LANG
if (menu->en_dname == NULL)
should_advance = TRUE;
--- 1429,1439 ----
{
#ifdef FEAT_MULTI_LANG
if (should_advance)
! vim_strncpy(tbuffer, menu->en_dname, TBUFFER_LEN - 2);
else
{
#endif
! vim_strncpy(tbuffer, menu->dname, TBUFFER_LEN - 2);
#ifdef FEAT_MULTI_LANG
if (menu->en_dname == NULL)
should_advance = TRUE;
*** ../vim-7.3.159/src/misc1.c 2011-04-11 14:27:34.000000000 +0200
--- src/misc1.c 2011-04-11 16:03:22.000000000 +0200
***************
*** 3332,3350 ****
if (pn == 1)
{
if (n > 0)
! STRCPY(msg_buf, _("1 more line"));
else
! STRCPY(msg_buf, _("1 line less"));
}
else
{
if (n > 0)
! sprintf((char *)msg_buf, _("%ld more lines"), pn);
else
! sprintf((char *)msg_buf, _("%ld fewer lines"), pn);
}
if (got_int)
! STRCAT(msg_buf, _(" (Interrupted)"));
if (msg(msg_buf))
{
set_keep_msg(msg_buf, 0);
--- 3332,3354 ----
if (pn == 1)
{
if (n > 0)
! vim_strncpy(msg_buf, (char_u *)_("1 more line"),
! MSG_BUF_LEN - 1);
else
! vim_strncpy(msg_buf, (char_u *)_("1 line less"),
! MSG_BUF_LEN - 1);
}
else
{
if (n > 0)
! vim_snprintf((char *)msg_buf, MSG_BUF_LEN,
! _("%ld more lines"), pn);
else
! vim_snprintf((char *)msg_buf, MSG_BUF_LEN,
! _("%ld fewer lines"), pn);
}
if (got_int)
! vim_strcat(msg_buf, (char_u *)_(" (Interrupted)"), MSG_BUF_LEN);
if (msg(msg_buf))
{
set_keep_msg(msg_buf, 0);
*** ../vim-7.3.159/src/misc2.c 2010-12-08 13:11:15.000000000 +0100
--- src/misc2.c 2011-04-11 15:30:20.000000000 +0200
***************
*** 1647,1652 ****
--- 1647,1674 ----
}
/*
+ * Like strcat(), but make sure the result fits in "tosize" bytes and is
+ * always NUL terminated.
+ */
+ void
+ vim_strcat(to, from, tosize)
+ char_u *to;
+ char_u *from;
+ size_t tosize;
+ {
+ size_t tolen = STRLEN(to);
+ size_t fromlen = STRLEN(from);
+
+ if (tolen + fromlen + 1 > tosize)
+ {
+ mch_memmove(to + tolen, from, tosize - tolen - 1);
+ to[tosize - 1] = NUL;
+ }
+ else
+ STRCPY(to + tolen, from);
+ }
+
+ /*
* Isolate one part of a string option where parts are separated with
* "sep_chars".
* The part is copied into "buf[maxlen]".
*** ../vim-7.3.159/src/proto/misc2.pro 2010-08-15 21:57:28.000000000 +0200
--- src/proto/misc2.pro 2011-04-11 15:29:55.000000000 +0200
***************
*** 40,45 ****
--- 40,46 ----
void copy_chars __ARGS((char_u *ptr, size_t count, int c));
void del_trailing_spaces __ARGS((char_u *ptr));
void vim_strncpy __ARGS((char_u *to, char_u *from, size_t len));
+ void vim_strcat __ARGS((char_u *to, char_u *from, size_t tosize));
int copy_option_part __ARGS((char_u **option, char_u *buf, int maxlen, char
*sep_chars));
void vim_free __ARGS((void *x));
int vim_stricmp __ARGS((char *s1, char *s2));
*** ../vim-7.3.159/src/netbeans.c 2011-04-01 15:33:54.000000000 +0200
--- src/netbeans.c 2011-04-11 16:02:51.000000000 +0200
***************
*** 3914,3927 ****
}
else
{
! char_u ebuf[BUFSIZ];
! STRCPY(ebuf, (char_u *)_("E505: "));
! STRCAT(ebuf, IObuff);
! STRCAT(ebuf, (char_u *)_("is read-only (add ! to override)"));
! STRCPY(IObuff, ebuf);
! nbdebug((" %s\n", ebuf ));
! emsg(IObuff);
}
}
--- 3914,3925 ----
}
else
{
! char_u msgbuf[IOSIZE];
! vim_snprintf((char *)msgbuf, IOSIZE,
! _("E505: %s is read-only (add ! to override)"), IObuff);
! nbdebug((" %s\n", msgbuf));
! emsg(msgbuf);
}
}
*** ../vim-7.3.159/src/os_unix.c 2011-02-15 17:39:14.000000000 +0100
--- src/os_unix.c 2011-04-11 16:39:11.000000000 +0200
***************
*** 5725,5730 ****
--- 5725,5731 ----
if (shell_style == STYLE_PRINT && !did_find_nul)
{
/* If there is a NUL, set did_find_nul, else set check_spaces */
+ buffer[len] = NUL;
if (len && (int)STRLEN(buffer) < (int)len - 1)
did_find_nul = TRUE;
else
***************
*** 6594,6600 ****
xterm_hints.x = 2;
return TRUE;
}
! if (mouse_code == NULL)
{
xterm_trace = 0;
return FALSE;
--- 6595,6601 ----
xterm_hints.x = 2;
return TRUE;
}
! if (mouse_code == NULL || STRLEN(mouse_code) > 45)
{
xterm_trace = 0;
return FALSE;
*** ../vim-7.3.159/src/spell.c 2011-02-01 13:59:44.000000000 +0100
--- src/spell.c 2011-04-11 15:50:40.000000000 +0200
***************
*** 6957,6963 ****
if (ae->ae_add == NULL)
*newword = NUL;
else
! STRCPY(newword, ae->ae_add);
p = word;
if (ae->ae_chop != NULL)
{
--- 6957,6963 ----
if (ae->ae_add == NULL)
*newword = NUL;
else
! vim_strncpy(newword, ae->ae_add, MAXWLEN - 1);
p = word;
if (ae->ae_chop != NULL)
{
***************
*** 6978,6984 ****
else
{
/* suffix: chop/add at the end of the word */
! STRCPY(newword, word);
if (ae->ae_chop != NULL)
{
/* Remove chop string. */
--- 6978,6984 ----
else
{
/* suffix: chop/add at the end of the word */
! vim_strncpy(newword, word, MAXWLEN - 1);
if (ae->ae_chop != NULL)
{
/* Remove chop string. */
***************
*** 8654,8660 ****
* Write the .sug file.
* Make the file name by changing ".spl" to ".sug".
*/
! STRCPY(fname, wfname);
len = (int)STRLEN(fname);
fname[len - 2] = 'u';
fname[len - 1] = 'g';
--- 8654,8660 ----
* Write the .sug file.
* Make the file name by changing ".spl" to ".sug".
*/
! vim_strncpy(fname, wfname, MAXPATHL - 1);
len = (int)STRLEN(fname);
fname[len - 2] = 'u';
fname[len - 1] = 'g';
***************
*** 10261,10267 ****
/* The suggested word may replace only part of the bad word, add
* the not replaced part. */
! STRCPY(wcopy, stp->st_word);
if (sug.su_badlen > stp->st_orglen)
vim_strncpy(wcopy + stp->st_wordlen,
sug.su_badptr + stp->st_orglen,
--- 10261,10267 ----
/* The suggested word may replace only part of the bad word, add
* the not replaced part. */
! vim_strncpy(wcopy, stp->st_word, MAXWLEN);
if (sug.su_badlen > stp->st_orglen)
vim_strncpy(wcopy + stp->st_wordlen,
sug.su_badptr + stp->st_orglen,
***************
*** 13162,13168 ****
pbad = badsound2;
}
! if (lendiff > 0)
{
/* Add part of the bad word to the good word, so that we soundfold
* what replaces the bad word. */
--- 13162,13168 ----
pbad = badsound2;
}
! if (lendiff > 0 && stp->st_wordlen + lendiff < MAXWLEN)
{
/* Add part of the bad word to the good word, so that we soundfold
* what replaces the bad word. */
***************
*** 13875,13881 ****
for (i = gap->ga_len - 1; i >= 0; --i)
{
/* Need to append what follows to check for "the the". */
! STRCPY(longword, stp[i].st_word);
len = stp[i].st_wordlen;
vim_strncpy(longword + len, su->su_badptr + stp[i].st_orglen,
MAXWLEN - len);
--- 13875,13881 ----
for (i = gap->ga_len - 1; i >= 0; --i)
{
/* Need to append what follows to check for "the the". */
! vim_strncpy(longword, stp[i].st_word, MAXWLEN);
len = stp[i].st_wordlen;
vim_strncpy(longword + len, su->su_badptr + stp[i].st_orglen,
MAXWLEN - len);
***************
*** 14221,14227 ****
*t = NUL;
}
else
! STRCPY(word, s);
smp = (salitem_T *)slang->sl_sal.ga_data;
--- 14221,14227 ----
*t = NUL;
}
else
! vim_strncpy(word, s, MAXWLEN - 1);
smp = (salitem_T *)slang->sl_sal.ga_data;
*** ../vim-7.3.159/src/syntax.c 2011-04-02 15:12:45.000000000 +0200
--- src/syntax.c 2011-04-11 15:44:30.000000000 +0200
***************
*** 8576,8583 ****
if (iarg & hl_attr_table[i])
{
if (buf[0] != NUL)
! STRCAT(buf, ",");
! STRCAT(buf, hl_name_table[i]);
iarg &= ~hl_attr_table[i]; /* don't want "inverse" */
}
}
--- 8576,8583 ----
if (iarg & hl_attr_table[i])
{
if (buf[0] != NUL)
! vim_strcat(buf, (char_u *)",", 100);
! vim_strcat(buf, (char_u *)hl_name_table[i], 100);
iarg &= ~hl_attr_table[i]; /* don't want "inverse" */
}
}
*** ../vim-7.3.159/src/tag.c 2011-02-25 15:13:43.000000000 +0100
--- src/tag.c 2011-04-11 15:34:59.000000000 +0200
***************
*** 806,812 ****
p = tag_full_fname(&tagp);
if (p == NULL)
continue;
! STRCPY(fname, p);
vim_free(p);
/*
--- 806,812 ----
p = tag_full_fname(&tagp);
if (p == NULL)
continue;
! vim_strncpy(fname, p, MAXPATHL);
vim_free(p);
/*
*** ../vim-7.3.159/src/version.c 2011-04-11 14:29:13.000000000 +0200
--- src/version.c 2011-04-11 16:50:53.000000000 +0200
***************
*** 716,717 ****
--- 716,719 ----
{ /* Add new patch number below this line */
+ /**/
+ 160,
/**/
--
If someone questions your market projections, simply point out that your
target market is "People who are nuts" and "People who will buy any damn
thing". Nobody is going to tell you there aren't enough of those people
to go around.
(Scott Adams - The Dilbert principle)
/// Bram Moolenaar -- [email protected] -- http://www.Moolenaar.net \\\
/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ an exciting new programming language -- http://www.Zimbu.org ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
