patch 9.0.1740: segfault when reading invalid viminfo file
Commit:
https://github.com/vim/vim/commit/0a0764684591c7c6a5d722b628f11dc96208e853
Author: Pierre Colin <[email protected]>
Date: Sat Aug 19 11:56:57 2023 +0200
patch 9.0.1740: segfault when reading invalid viminfo file
Problem: segfault when reading invalid viminfo file
Solution: Check the expected type in the viminfo file
Thanks to @yegappan for the included test.
closes: #12652
closes: #12845
Signed-off-by: Christian Brabandt <[email protected]>
Co-authored-by: Pierre Colin
<[email protected]>
Co-authored-by: Yegappan Lakshmanan <[email protected]>
Co-authored-by: Christian Brabandt <[email protected]>
diff --git a/src/testdir/test_viminfo.vim b/src/testdir/test_viminfo.vim
index 0551ea1b4..1f4a72db1 100644
--- a/src/testdir/test_viminfo.vim
+++ b/src/testdir/test_viminfo.vim
@@ -614,6 +614,26 @@ func Test_viminfo_bad_syntax2()
rviminfo Xviminfo
endfunc
+" This used to crash Vim (GitHub issue #12652)
+func Test_viminfo_bad_syntax3()
+ let lines =<< trim END
+ call writefile([], 'Xvbs3.result')
+ qall!
+ END
+ call writefile(lines, 'Xvbs3script', 'D')
+
+ let lines = []
+ call add(lines, '|1,4')
+ " bad viminfo syntax for register barline
+ call add(lines, '|3,1,1,1,1,0,71489,,125') " empty line1
+ call writefile(lines, 'Xviminfo', 'D')
+
+ call RunVim([], [], '--clean -i Xviminfo -S Xvbs3script')
+ call assert_true(filereadable('Xvbs3.result'))
+
+ call delete('Xvbs3.result')
+endfunc
+
func Test_viminfo_file_marks()
silent! bwipe test_viminfo.vim
silent! bwipe Xviminfo
diff --git a/src/version.c b/src/version.c
index 52d128a9c..fbf4c6869 100644
--- a/src/version.c
+++ b/src/version.c
@@ -695,6 +695,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 1740,
/**/
1739,
/**/
diff --git a/src/viminfo.c b/src/viminfo.c
index b772fc8f3..fbab05eb7 100644
--- a/src/viminfo.c
+++ b/src/viminfo.c
@@ -1804,6 +1804,11 @@ handle_viminfo_register(garray_T *values, int force)
y_ptr->y_array[i] = vp[i + 6].bv_string;
vp[i + 6].bv_string = NULL;
}
+ else if (vp[i + 6].bv_type != BVAL_STRING)
+ {
+ free(y_ptr->y_array);
+ y_ptr->y_array = NULL;
+ }
else
y_ptr->y_array[i] = vim_strsave(vp[i + 6].bv_string);
}
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/vim_dev/E1qXIz1-008s9C-LC%40256bit.org.
