Skip to content

Commit 423977d

Browse files
committed
patch 8.0.0212: buffer for key name may be too small
Problem: The buffer used to store a key name theoreticaly could be too small. (Coverity) Solution: Count all possible modifier characters. Add a check for the length just in case.
1 parent 560379d commit 423977d

3 files changed

Lines changed: 14 additions & 4 deletions

File tree

src/keymap.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -482,9 +482,10 @@ enum key_extra
482482

483483
/*
484484
* The length of the longest special key name, including modifiers.
485-
* Current longest is <M-C-S-T-4-MiddleRelease> (length includes '<' and '>').
485+
* Current longest is <M-C-S-T-D-A-4-ScrollWheelRight> (length includes '<' and
486+
* '>').
486487
*/
487-
#define MAX_KEY_NAME_LEN 25
488+
#define MAX_KEY_NAME_LEN 32
488489

489490
/* Maximum length of a special key event as tokens. This includes modifiers.
490491
* The longest event is something like <M-C-S-T-4-LeftDrag> which would be the

src/misc2.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2162,6 +2162,7 @@ static struct modmasktable
21622162
/* 'A' must be the last one */
21632163
{MOD_MASK_ALT, MOD_MASK_ALT, (char_u)'A'},
21642164
{0, 0, NUL}
2165+
/* NOTE: when adding an entry, update MAX_KEY_NAME_LEN! */
21652166
};
21662167

21672168
/*
@@ -2431,6 +2432,7 @@ static struct key_name_entry
24312432
{K_PLUG, (char_u *)"Plug"},
24322433
{K_CURSORHOLD, (char_u *)"CursorHold"},
24332434
{0, NULL}
2435+
/* NOTE: When adding a long name update MAX_KEY_NAME_LEN. */
24342436
};
24352437

24362438
#define KEY_NAMES_TABLE_LEN (sizeof(key_names_table) / sizeof(struct key_name_entry))
@@ -2659,8 +2661,13 @@ get_special_key_name(int c, int modifiers)
26592661
}
26602662
else /* use name of special key */
26612663
{
2662-
STRCPY(string + idx, key_names_table[table_idx].name);
2663-
idx = (int)STRLEN(string);
2664+
size_t len = STRLEN(key_names_table[table_idx].name);
2665+
2666+
if (len + idx + 2 <= MAX_KEY_NAME_LEN)
2667+
{
2668+
STRCPY(string + idx, key_names_table[table_idx].name);
2669+
idx += (int)len;
2670+
}
26642671
}
26652672
string[idx++] = '>';
26662673
string[idx] = NUL;

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -764,6 +764,8 @@ static char *(features[]) =
764764

765765
static int included_patches[] =
766766
{ /* Add new patch number below this line */
767+
/**/
768+
212,
767769
/**/
768770
211,
769771
/**/

0 commit comments

Comments
 (0)