Skip to content

Commit 132f752

Browse files
committed
patch 8.0.1409: buffer overflow in :tags command
Problem: Buffer overflow in :tags command. Solution: Use vim_snprintf(). (Dominique Pelle, closes #2471, closes #2475) Add a test.
1 parent a0ca7d0 commit 132f752

3 files changed

Lines changed: 9 additions & 2 deletions

File tree

src/tag.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1130,7 +1130,7 @@ do_tags(exarg_T *eap UNUSED)
11301130
continue;
11311131

11321132
msg_putchar('\n');
1133-
sprintf((char *)IObuff, "%c%2d %2d %-15s %5ld ",
1133+
vim_snprintf((char *)IObuff, IOSIZE, "%c%2d %2d %-15s %5ld ",
11341134
i == tagstackidx ? '>' : ' ',
11351135
i + 1,
11361136
tagstack[i].cur_match + 1,

src/testdir/test_taglist.vim

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
" test 'taglist' function
1+
" test 'taglist' function and :tags command
22

33
func Test_taglist()
44
call writefile([
@@ -56,3 +56,8 @@ func Test_taglist_ctags_etags()
5656

5757
call delete('Xtags')
5858
endfunc
59+
60+
func Test_tags_too_long()
61+
call assert_fails('tag ' . repeat('x', 1020), 'E426')
62+
tags
63+
endfunc

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -771,6 +771,8 @@ static char *(features[]) =
771771

772772
static int included_patches[] =
773773
{ /* Add new patch number below this line */
774+
/**/
775+
1409,
774776
/**/
775777
1408,
776778
/**/

0 commit comments

Comments
 (0)