Patch 8.0.0212
Problem: The buffer used to store a key name theoreticaly could be too
small. (Coverity)
Solution: Count all possible modifier characters. Add a check for the
length just in case.
Files: src/keymap.h, src/misc2.c
*** ../vim-8.0.0211/src/keymap.h 2017-01-21 20:04:17.562757816 +0100
--- src/keymap.h 2017-01-22 14:48:17.014376869 +0100
***************
*** 482,490 ****
/*
* The length of the longest special key name, including modifiers.
! * Current longest is <M-C-S-T-4-MiddleRelease> (length includes '<' and '>').
*/
! #define MAX_KEY_NAME_LEN 25
/* Maximum length of a special key event as tokens. This includes modifiers.
* The longest event is something like <M-C-S-T-4-LeftDrag> which would be the
--- 482,491 ----
/*
* The length of the longest special key name, including modifiers.
! * Current longest is <M-C-S-T-D-A-4-ScrollWheelRight> (length includes '<'
and
! * '>').
*/
! #define MAX_KEY_NAME_LEN 32
/* Maximum length of a special key event as tokens. This includes modifiers.
* The longest event is something like <M-C-S-T-4-LeftDrag> which would be the
*** ../vim-8.0.0211/src/misc2.c 2017-01-21 20:04:17.562757816 +0100
--- src/misc2.c 2017-01-22 15:05:01.588040025 +0100
***************
*** 2162,2167 ****
--- 2162,2168 ----
/* 'A' must be the last one */
{MOD_MASK_ALT, MOD_MASK_ALT, (char_u)'A'},
{0, 0, NUL}
+ /* NOTE: when adding an entry, update MAX_KEY_NAME_LEN! */
};
/*
***************
*** 2431,2436 ****
--- 2432,2438 ----
{K_PLUG, (char_u *)"Plug"},
{K_CURSORHOLD, (char_u *)"CursorHold"},
{0, NULL}
+ /* NOTE: When adding a long name update MAX_KEY_NAME_LEN. */
};
#define KEY_NAMES_TABLE_LEN (sizeof(key_names_table) / sizeof(struct
key_name_entry))
***************
*** 2659,2666 ****
}
else /* use name of special key */
{
! STRCPY(string + idx, key_names_table[table_idx].name);
! idx = (int)STRLEN(string);
}
string[idx++] = '>';
string[idx] = NUL;
--- 2661,2673 ----
}
else /* use name of special key */
{
! size_t len = STRLEN(key_names_table[table_idx].name);
!
! if (len + idx + 2 <= MAX_KEY_NAME_LEN)
! {
! STRCPY(string + idx, key_names_table[table_idx].name);
! idx += (int)len;
! }
}
string[idx++] = '>';
string[idx] = NUL;
*** ../vim-8.0.0211/src/version.c 2017-01-21 22:49:56.142666237 +0100
--- src/version.c 2017-01-22 15:03:49.780492910 +0100
***************
*** 766,767 ****
--- 766,769 ----
{ /* Add new patch number below this line */
+ /**/
+ 212,
/**/
--
You had connectors? Eeee, when I were a lad we 'ad to carry the
bits between the computer and the terminal with a spoon...
/// Bram Moolenaar -- [email protected] -- http://www.Moolenaar.net \\\
/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ an exciting new programming language -- http://www.Zimbu.org ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
