To: vim-dev@vim.org Subject: patch 7.1.020 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit ------------ Patch 7.1.020 Problem: Reading from uninitialized memory when using a dialog. (Dominique Pelle) Solution: In msg_show_console_dialog() append a NUL after every appended character. Files: src/message.c *** ../vim-7.1.019/src/message.c Thu May 10 18:49:39 2007 --- src/message.c Sun Jul 1 12:06:52 2007 *************** *** 3456,3466 **** /* advance to next hotkey and set default hotkey */ #ifdef FEAT_MBYTE if (has_mbyte) ! hotkp += (*mb_ptr2len)(hotkp); else #endif ++hotkp; ! (void)copy_char(r + 1, hotkp, TRUE); if (dfltbutton) --dfltbutton; --- 3456,3466 ---- /* advance to next hotkey and set default hotkey */ #ifdef FEAT_MBYTE if (has_mbyte) ! hotkp += STRLEN(hotkp); else #endif ++hotkp; ! hotkp[copy_char(r + 1, hotkp, TRUE)] = NUL; if (dfltbutton) --dfltbutton; *************** *** 3493,3499 **** *msgp++ = (dfltbutton == 1) ? ']' : ')'; /* redefine hotkey */ ! (void)copy_char(r, hotkp, TRUE); } } else --- 3493,3499 ---- *msgp++ = (dfltbutton == 1) ? ']' : ')'; /* redefine hotkey */ ! hotkp[copy_char(r, hotkp, TRUE)] = NUL; } } else *************** *** 3519,3526 **** *msgp++ = ':'; *msgp++ = ' '; *msgp = NUL; - mb_ptr_adv(hotkp); - *hotkp = NUL; } else { --- 3519,3524 ---- *************** *** 3555,3562 **** msgp = confirm_msg + 1 + STRLEN(message); hotkp = hotk; ! /* define first default hotkey */ ! (void)copy_char(buttons, hotkp, TRUE); /* Remember where the choices start, displaying starts here when * "hotkp" typed at the more prompt. */ --- 3553,3561 ---- msgp = confirm_msg + 1 + STRLEN(message); hotkp = hotk; ! /* Define first default hotkey. Keep the hotkey string NUL ! * terminated to avoid reading past the end. */ ! hotkp[copy_char(buttons, hotkp, TRUE)] = NUL; /* Remember where the choices start, displaying starts here when * "hotkp" typed at the more prompt. */ *** ../vim-7.1.019/src/version.c Thu Jul 5 09:53:20 2007 --- src/version.c Thu Jul 5 10:09:34 2007 *************** *** 668,669 **** --- 668,671 ---- { /* Add new patch number below this line */ + /**/ + 20, /**/ -- BLACK KNIGHT: Come on you pansy! [hah] [parry thrust] [ARTHUR chops the BLACK KNIGHT's right arm off] ARTHUR: Victory is mine! [kneeling] We thank thee Lord, that in thy merc- [Black Knight kicks Arthur in the head while he is praying] The Quest for the Holy Grail (Monty Python) /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\ \\\ download, build and distribute -- http://www.A-A-P.org /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///