To: vim_dev@googlegroups.com Subject: Patch 8.0.0212 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ------------ Patch 8.0.0212 Problem: The buffer used to store a key name theoreticaly could be too small. (Coverity) Solution: Count all possible modifier characters. Add a check for the length just in case. Files: src/keymap.h, src/misc2.c *** ../vim-8.0.0211/src/keymap.h 2017-01-21 20:04:17.562757816 +0100 --- src/keymap.h 2017-01-22 14:48:17.014376869 +0100 *************** *** 482,490 **** /* * The length of the longest special key name, including modifiers. ! * Current longest is (length includes '<' and '>'). */ ! #define MAX_KEY_NAME_LEN 25 /* Maximum length of a special key event as tokens. This includes modifiers. * The longest event is something like which would be the --- 482,491 ---- /* * The length of the longest special key name, including modifiers. ! * Current longest is (length includes '<' and ! * '>'). */ ! #define MAX_KEY_NAME_LEN 32 /* Maximum length of a special key event as tokens. This includes modifiers. * The longest event is something like which would be the *** ../vim-8.0.0211/src/misc2.c 2017-01-21 20:04:17.562757816 +0100 --- src/misc2.c 2017-01-22 15:05:01.588040025 +0100 *************** *** 2162,2167 **** --- 2162,2168 ---- /* 'A' must be the last one */ {MOD_MASK_ALT, MOD_MASK_ALT, (char_u)'A'}, {0, 0, NUL} + /* NOTE: when adding an entry, update MAX_KEY_NAME_LEN! */ }; /* *************** *** 2431,2436 **** --- 2432,2438 ---- {K_PLUG, (char_u *)"Plug"}, {K_CURSORHOLD, (char_u *)"CursorHold"}, {0, NULL} + /* NOTE: When adding a long name update MAX_KEY_NAME_LEN. */ }; #define KEY_NAMES_TABLE_LEN (sizeof(key_names_table) / sizeof(struct key_name_entry)) *************** *** 2659,2666 **** } else /* use name of special key */ { ! STRCPY(string + idx, key_names_table[table_idx].name); ! idx = (int)STRLEN(string); } string[idx++] = '>'; string[idx] = NUL; --- 2661,2673 ---- } else /* use name of special key */ { ! size_t len = STRLEN(key_names_table[table_idx].name); ! ! if (len + idx + 2 <= MAX_KEY_NAME_LEN) ! { ! STRCPY(string + idx, key_names_table[table_idx].name); ! idx += (int)len; ! } } string[idx++] = '>'; string[idx] = NUL; *** ../vim-8.0.0211/src/version.c 2017-01-21 22:49:56.142666237 +0100 --- src/version.c 2017-01-22 15:03:49.780492910 +0100 *************** *** 766,767 **** --- 766,769 ---- { /* Add new patch number below this line */ + /**/ + 212, /**/ -- You had connectors? Eeee, when I were a lad we 'ad to carry the bits between the computer and the terminal with a spoon... /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\ \\\ an exciting new programming language -- http://www.Zimbu.org /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///