To: vim-dev@vim.org

Subject: patch 7.1.087

Fcc: outbox

From: Bram Moolenaar <Bram@moolenaar.net>

Mime-Version: 1.0

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 8bit

------------

Patch 7.1.087

Problem:    Reading past ":cscope find" command.  Writing past end of a buffer.

Solution:   Check length of the argument before using the pattern.  Use

	    vim_strncpy().  (Dominique Pelle)

Files:	    if_cscope.c

*** ../vim-7.1.086/src/if_cscope.c	Sun Mar 11 15:48:29 2007

--- src/if_cscope.c	Sun Aug 19 22:17:09 2007

***************

*** 73,78 ****

--- 73,80 ----

  static csinfo_T	    csinfo[CSCOPE_MAX_CONNECTIONS];

+ static int	    eap_arg_len;    /* length of eap->arg, set in

+ 				       cs_lookup_cmd() */

  static cscmd_T	    cs_cmds[] =

  {

      { "add",	cs_add,

***************

*** 260,273 ****

      if ((p = cs_manage_matches(NULL, NULL, -1, Get)) == NULL)

  	return TRUE;

! 

!     if ((int)strlen(p) > size)

!     {

! 	strncpy((char *)buf, p, size - 1);

! 	buf[size] = '\0';

!     }

!     else

! 	(void)strcpy((char *)buf, p);

      return FALSE;

  } /* cs_fgets */

--- 262,268 ----

      if ((p = cs_manage_matches(NULL, NULL, -1, Get)) == NULL)

  	return TRUE;

!     vim_strncpy(buf, (char_u *)p, size - 1);

      return FALSE;

  } /* cs_fgets */

***************

*** 386,392 ****

   * PRIVATE: cs_add

   *

   * add cscope database or a directory name (to look for cscope.out)

!  * the the cscope connection list

   *

   * MAXPATHL 256

   */

--- 381,387 ----

   * PRIVATE: cs_add

   *

   * add cscope database or a directory name (to look for cscope.out)

!  * to the cscope connection list

   *

   * MAXPATHL 256

   */

***************

*** 966,972 ****

      }

      pat = opt + strlen(opt) + 1;

!     if (pat == NULL || (pat != NULL && pat[0] == '\0'))

      {

  	cs_usage_msg(Find);

  	return FALSE;

--- 961,967 ----

      }

      pat = opt + strlen(opt) + 1;

!     if (pat >= (char *)eap->arg + eap_arg_len)

      {

  	cs_usage_msg(Find);

  	return FALSE;

***************

*** 1317,1323 ****

  #else

  	    /* compare pathnames first */

  	    && ((fullpathcmp(csinfo[j].fname, fname, FALSE) & FPC_SAME)

! 		/* if not Windows 9x, test index file atributes too */

  		|| (!mch_windows95()

  		    && csinfo[j].nVolume == bhfi.dwVolumeSerialNumber

  		    && csinfo[j].nIndexHigh == bhfi.nFileIndexHigh

--- 1312,1318 ----

  #else

  	    /* compare pathnames first */

  	    && ((fullpathcmp(csinfo[j].fname, fname, FALSE) & FPC_SAME)

! 		/* if not Windows 9x, test index file attributes too */

  		|| (!mch_windows95()

  		    && csinfo[j].nVolume == bhfi.dwVolumeSerialNumber

  		    && csinfo[j].nIndexHigh == bhfi.nFileIndexHigh

***************

*** 1401,1406 ****

--- 1396,1404 ----

      if (eap->arg == NULL)

  	return NULL;

+     /* Store length of eap->arg before it gets modified by strtok(). */

+     eap_arg_len = STRLEN(eap->arg);

+ 

      if ((stok = strtok((char *)(eap->arg), (const char *)" ")) == NULL)

  	return NULL;

***************

*** 2195,2201 ****

  	    cs_add_common(dblist[i], pplist[i], fllist[i]);

  	    if (p_csverbose)

  	    {

! 		/* dont' use smsg_attr because want to display

  		 * connection number in the same line as

  		 * "Added cscope database..."

  		 */

--- 2193,2199 ----

  	    cs_add_common(dblist[i], pplist[i], fllist[i]);

  	    if (p_csverbose)

  	    {

! 		/* don't use smsg_attr() because we want to display the

  		 * connection number in the same line as

  		 * "Added cscope database..."

  		 */

*** ../vim-7.1.086/src/version.c	Tue Aug 21 17:29:04 2007

--- src/version.c	Tue Aug 21 17:59:42 2007

***************

*** 668,669 ****

--- 668,671 ----

  {   /* Add new patch number below this line */

+ /**/

+     87,

  /**/

-- 

hundred-and-one symptoms of being an internet addict:

223. You set up a web-cam as your home's security system.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\

///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\

\\\        download, build and distribute -- http://www.A-A-P.org        ///

 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///