To: vim_dev@googlegroups.com
Subject: Patch 8.2.3855
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 8.2.3855
Problem:    Illegal memory access when displaying a blob.
Solution:   Append a NUL at the end. (Yegappan Lakshmanan, closes #9372)
Files:      src/blob.c, src/regexp_nfa.c, src/testdir/test_blob.vim,
            src/testdir/test_messages.vim


*** ../vim-8.2.3854/src/blob.c	2021-12-05 22:19:22.832153464 +0000
--- src/blob.c	2021-12-19 19:13:51.550933410 +0000
***************
*** 240,245 ****
--- 240,246 ----
  	vim_snprintf((char *)numbuf, NUMBUFLEN, "%02X", (int)blob_get(blob, i));
  	ga_concat(&ga, numbuf);
      }
+     ga_append(&ga, NUL);		// append a NUL at the end
      *tofree = ga.ga_data;
      return *tofree;
  }
*** ../vim-8.2.3854/src/regexp_nfa.c	2021-12-16 14:45:09.361563197 +0000
--- src/regexp_nfa.c	2021-12-19 19:13:51.554933405 +0000
***************
*** 2917,2936 ****
  	ga_concat(indent, (char_u *)"| ");
      else
  	ga_concat(indent, (char_u *)"  ");
!     ga_append(indent, '\0');
  
      nfa_print_state2(debugf, state->out, indent);
  
      // replace last part of indent for state->out1
      indent->ga_len -= 3;
      ga_concat(indent, (char_u *)"  ");
!     ga_append(indent, '\0');
  
      nfa_print_state2(debugf, state->out1, indent);
  
      // shrink indent
      indent->ga_len -= 3;
!     ga_append(indent, '\0');
  }
  
  /*
--- 2917,2936 ----
  	ga_concat(indent, (char_u *)"| ");
      else
  	ga_concat(indent, (char_u *)"  ");
!     ga_append(indent, NUL);
  
      nfa_print_state2(debugf, state->out, indent);
  
      // replace last part of indent for state->out1
      indent->ga_len -= 3;
      ga_concat(indent, (char_u *)"  ");
!     ga_append(indent, NUL);
  
      nfa_print_state2(debugf, state->out1, indent);
  
      // shrink indent
      indent->ga_len -= 3;
!     ga_append(indent, NUL);
  }
  
  /*
*** ../vim-8.2.3854/src/testdir/test_blob.vim	2021-12-03 13:56:57.195519128 +0000
--- src/testdir/test_blob.vim	2021-12-19 19:18:53.962476770 +0000
***************
*** 680,684 ****
--- 680,691 ----
    call assert_equal(0z00010203, list2blob(range(4)))
  endfunc
  
+ " The following used to cause an out-of-bounds memory access
+ func Test_blob2string()
+   let v = '0z' .. repeat('01010101.', 444)
+   let v ..= '01'
+   exe 'let b = ' .. v
+   call assert_equal(v, string(b))
+ endfunc
  
  " vim: shiftwidth=2 sts=2 expandtab
*** ../vim-8.2.3854/src/testdir/test_messages.vim	2021-12-19 11:06:19.666495254 +0000
--- src/testdir/test_messages.vim	2021-12-19 19:13:51.554933405 +0000
***************
*** 341,347 ****
  func Test_echo_string_partial()
    function CountSpaces()
    endfunction
!   echomsg function('CountSpaces', [#{aaaaaaaaaaa: v:false, bbbbbbbbbbbb: '', ccccccccccc: ['ab', 'cd']}])
  endfunc
  
  " vim: shiftwidth=2 sts=2 expandtab
--- 341,347 ----
  func Test_echo_string_partial()
    function CountSpaces()
    endfunction
!   call assert_equal("function('CountSpaces', [{'ccccccccccc': ['ab', 'cd'], 'aaaaaaaaaaa': v:false, 'bbbbbbbbbbbb': ''}])", string(function('CountSpaces', [#{aaaaaaaaaaa: v:false, bbbbbbbbbbbb: '', ccccccccccc: ['ab', 'cd']}])))
  endfunc
  
  " vim: shiftwidth=2 sts=2 expandtab
*** ../vim-8.2.3854/src/version.c	2021-12-19 18:33:17.325954806 +0000
--- src/version.c	2021-12-19 19:15:21.218799756 +0000
***************
*** 751,752 ****
--- 751,754 ----
  {   /* Add new patch number below this line */
+ /**/
+     3855,
  /**/

-- 
ASCII stupid question, get a stupid ANSI.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///                                                                      \\\
\\\        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///