Hi,
On Sat, Apr 30, 2016 at 10:50 AM, Bram Moolenaar <[email protected]> wrote:
>
> Anton Lindqvist wrote:
>
>> > > I managed to crash Vim yesterday due to a off-by-one allocation bug
>> > > related to the quickfix changes. Fixed in the attached patch.
>> >
>> > Well, if I run test_quickfix after including this patch, Vim crashes.
>> > I found that a statement was missing, setting linelen to len.
>> > I did some minor cleanups.
>>
>> Nice catch!
>>
>> > I'll include it now. However, the code to increase the size of the
>> > buffer is repeated three times, would be nice to put it in one place.
>>
Vim crashes when running the quickfix tests on a OS X system with the
latest Vim (1811). The fix for this crash is attached.
- Yegappan
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
diff --git a/src/quickfix.c b/src/quickfix.c
index 99db6d7..f671063 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -545,12 +545,12 @@ qf_init_ext(
linelen = len > LINE_MAXLEN ? LINE_MAXLEN - 1 : len;
if (growbuf == NULL)
{
- growbuf = alloc(linelen);
+ growbuf = alloc(linelen + 1);
growbufsiz = linelen;
}
else if (linelen > growbufsiz)
{
- growbuf = vim_realloc(growbuf, linelen);
+ growbuf = vim_realloc(growbuf, linelen + 1);
if (growbuf == NULL)
goto qf_init_end;
growbufsiz = linelen;
@@ -589,13 +589,13 @@ qf_init_ext(
linelen = LINE_MAXLEN - 1;
if (growbuf == NULL)
{
- growbuf = alloc(linelen);
+ growbuf = alloc(linelen + 1);
growbufsiz = linelen;
}
else if (linelen > growbufsiz)
{
if ((growbuf = vim_realloc(growbuf,
- linelen)) == NULL)
+ linelen + 1)) == NULL)
goto qf_init_end;
growbufsiz = linelen;
}
@@ -623,14 +623,14 @@ qf_init_ext(
{
if (growbuf == NULL)
{
- growbuf = alloc(linelen);
+ growbuf = alloc(linelen + 1);
growbufsiz = linelen;
}
else if (linelen > growbufsiz)
{
if (linelen > LINE_MAXLEN)
linelen = LINE_MAXLEN - 1;
- if ((growbuf = vim_realloc(growbuf, linelen)) == NULL)
+ if ((growbuf = vim_realloc(growbuf, linelen + 1)) ==
NULL)
goto qf_init_end;
growbufsiz = linelen;
}
