From 826bfe4bbd7594188e3d74d2539d9707b1c6a14b Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Fri, 8 Oct 2021 18:39:28 +0100 Subject: [PATCH] patch 8.2.3487: illegal memory access if buffer name is very long Problem: Illegal memory access if buffer name is very long. Solution: Make sure not to go over the end of the buffer. --- src/drawscreen.c | 10 +++++----- src/testdir/test_statusline.vim | 10 ++++++++++ 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/src/drawscreen.c b/src/drawscreen.c index 3a88ee9..9acb705 100644 --- a/src/drawscreen.c +++ b/src/drawscreen.c @@ -446,13 +446,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED) *(p + len++) = ' '; if (bt_help(wp->w_buffer)) { - STRCPY(p + len, _("[Help]")); + vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Help]")); len += (int)STRLEN(p + len); } #ifdef FEAT_QUICKFIX if (wp->w_p_pvw) { - STRCPY(p + len, _("[Preview]")); + vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Preview]")); len += (int)STRLEN(p + len); } #endif @@ -462,12 +462,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED) #endif ) { - STRCPY(p + len, "[+]"); - len += 3; + vim_snprintf((char *)p + len, MAXPATHL - len, "%s", "[+]"); + len += (int)STRLEN(p + len); } if (wp->w_buffer->b_p_ro) { - STRCPY(p + len, _("[RO]")); + vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[RO]")); len += (int)STRLEN(p + len); } diff --git a/src/testdir/test_statusline.vim b/src/testdir/test_statusline.vim index 1f705b8..febb5d6 100644 --- a/src/testdir/test_statusline.vim +++ b/src/testdir/test_statusline.vim @@ -393,3 +393,13 @@ func Test_statusline_visual() bwipe! x1 bwipe! x2 endfunc + +" Used to write beyond allocated memory. This assumes MAXPATHL is 4096 bytes. +func Test_statusline_verylong_filename() + let fname = repeat('x', 4090) + exe "new " .. fname + set buftype=help + set previewwindow + redraw + bwipe! +endfunc -- 2.27.0