Patch 8.0.1503
Problem:    Access memory beyond end of string. (Coverity)
Solution:   Keep allocated memory in separate pointer.  Avoid outputting the
            NUL character.
Files:      src/hardcopy.c


*** ../vim-8.0.1502/src/hardcopy.c      2018-02-10 18:45:21.064822187 +0100
--- src/hardcopy.c      2018-02-11 15:38:21.839020862 +0100
***************
*** 3382,3387 ****
--- 3382,3388 ----
  #ifdef FEAT_MBYTE
      int               in_ascii;
      int               half_width;
+     char_u    *tofree = NULL;
  #endif
  
      char_width = prt_char_width;
***************
*** 3507,3525 ****
  
  #ifdef FEAT_MBYTE
      if (prt_do_conv)
-     {
        /* Convert from multi-byte to 8-bit encoding */
!       p = string_convert(&prt_conv, p, &len);
!       if (p == NULL)
!           p = (char_u *)"";
!     }
  
      if (prt_out_mbyte)
      {
        /* Multi-byte character strings are represented more efficiently as hex
         * strings when outputting clean 8 bit PS.
         */
!       do
        {
            ch = prt_hexchar[(unsigned)(*p) >> 4];
            ga_append(&prt_ps_buffer, ch);
--- 3508,3522 ----
  
  #ifdef FEAT_MBYTE
      if (prt_do_conv)
        /* Convert from multi-byte to 8-bit encoding */
!       tofree = p = string_convert(&prt_conv, p, &len);
  
      if (prt_out_mbyte)
      {
        /* Multi-byte character strings are represented more efficiently as hex
         * strings when outputting clean 8 bit PS.
         */
!       while (len-- > 0)
        {
            ch = prt_hexchar[(unsigned)(*p) >> 4];
            ga_append(&prt_ps_buffer, ch);
***************
*** 3527,3533 ****
            ga_append(&prt_ps_buffer, ch);
            p++;
        }
-       while (--len);
      }
      else
  #endif
--- 3524,3529 ----
***************
*** 3574,3581 ****
  
  #ifdef FEAT_MBYTE
      /* Need to free any translated characters */
!     if (prt_do_conv && (*p != NUL))
!       vim_free(p);
  #endif
  
      prt_text_run += char_width;
--- 3570,3576 ----
  
  #ifdef FEAT_MBYTE
      /* Need to free any translated characters */
!     vim_free(tofree);
  #endif
  
      prt_text_run += char_width;
*** ../vim-8.0.1502/src/version.c       2018-02-11 15:20:16.298274009 +0100
--- src/version.c       2018-02-11 15:37:43.619273854 +0100
***************
*** 773,774 ****
--- 773,776 ----
  {   /* Add new patch number below this line */
+ /**/
+     1503,
  /**/

-- 
WOMAN:   I didn't know we had a king. I thought we were an autonomous
         collective.
DENNIS:  You're fooling yourself.  We're living in a dictatorship.  A
         self-perpetuating autocracy in which the working classes--
WOMAN:   Oh there you go, bringing class into it again.
DENNIS:  That's what it's all about if only people would--
                                  The Quest for the Holy Grail (Monty Python)

 /// Bram Moolenaar -- [email protected] -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Raspunde prin e-mail lui