To: vim_dev@googlegroups.com Subject: Patch 7.4.1702 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ------------ Patch 7.4.1702 Problem: Using freed memory when parsing 'printoptions' fails. Solution: Save the old options and restore them in case of an error. (Dominique) Files: src/hardcopy.c, src/testdir/test_hardcopy.vim *** ../vim-7.4.1701/src/hardcopy.c 2016-03-12 22:11:34.239300280 +0100 --- src/hardcopy.c 2016-04-03 14:49:28.694058400 +0200 *************** *** 189,194 **** --- 189,196 ---- option_table_T *table, int table_size) { + option_table_T *old_opts; + char_u *ret = NULL; char_u *stringp; char_u *colonp; char_u *commap; *************** *** 196,203 **** --- 198,213 ---- int idx = 0; /* init for GCC */ int len; + /* Save the old values, so that they can be restored in case of an error. */ + old_opts = (option_table_T *)alloc(sizeof(option_table_T) * table_size); + if (old_opts == NULL) + return NULL; + for (idx = 0; idx < table_size; ++idx) + { + old_opts[idx] = table[idx]; table[idx].present = FALSE; + } /* * Repeat for all comma separated parts. *************** *** 207,213 **** { colonp = vim_strchr(stringp, ':'); if (colonp == NULL) ! return (char_u *)N_("E550: Missing colon"); commap = vim_strchr(stringp, ','); if (commap == NULL) commap = option_str + STRLEN(option_str); --- 217,226 ---- { colonp = vim_strchr(stringp, ':'); if (colonp == NULL) ! { ! ret = (char_u *)N_("E550: Missing colon"); ! break; ! } commap = vim_strchr(stringp, ','); if (commap == NULL) commap = option_str + STRLEN(option_str); *************** *** 219,233 **** break; if (idx == table_size) ! return (char_u *)N_("E551: Illegal component"); ! p = colonp + 1; table[idx].present = TRUE; if (table[idx].hasnum) { if (!VIM_ISDIGIT(*p)) ! return (char_u *)N_("E552: digit expected"); table[idx].number = getdigits(&p); /*advances p*/ } --- 232,251 ---- break; if (idx == table_size) ! { ! ret = (char_u *)N_("E551: Illegal component"); ! break; ! } p = colonp + 1; table[idx].present = TRUE; if (table[idx].hasnum) { if (!VIM_ISDIGIT(*p)) ! { ! ret = (char_u *)N_("E552: digit expected"); ! break; ! } table[idx].number = getdigits(&p); /*advances p*/ } *************** *** 240,246 **** ++stringp; } ! return NULL; } --- 258,271 ---- ++stringp; } ! if (ret != NULL) ! { ! /* Restore old options in case of error */ ! for (idx = 0; idx < table_size; ++idx) ! table[idx] = old_opts[idx]; ! } ! vim_free(old_opts); ! return ret; } *** ../vim-7.4.1701/src/testdir/test_hardcopy.vim 2016-01-15 15:56:14.735293918 +0100 --- src/testdir/test_hardcopy.vim 2016-04-03 14:54:31.870952083 +0200 *************** *** 23,28 **** --- 23,32 ---- set printoptions=formfeed:y set printoptions= set printoptions& + + call assert_fails('set printoptions=paper', 'E550:') + call assert_fails('set printoptions=shredder:on', 'E551:') + call assert_fails('set printoptions=left:no', 'E552:') endfunc func Test_printmbfont_parsing() *** ../vim-7.4.1701/src/version.c 2016-04-03 14:09:55.494353474 +0200 --- src/version.c 2016-04-03 14:41:52.274726762 +0200 *************** *** 750,751 **** --- 750,753 ---- { /* Add new patch number below this line */ + /**/ + 1702, /**/ -- hundred-and-one symptoms of being an internet addict: 207. You're given one phone call in prison and you ask them for a laptop. /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\ \\\ an exciting new programming language -- http://www.Zimbu.org /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///