Skip to content

Commit ca24e2c

Browse files
committed
patch 8.0.0213: Netbeans specialKeys command does not check argument length
Problem: The Netbeans "specialKeys" command does not check if the argument fits in the buffer. (Coverity) Solution: Add a length check.
1 parent 423977d commit ca24e2c

2 files changed

Lines changed: 11 additions & 5 deletions

File tree

src/netbeans.c

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2332,7 +2332,8 @@ special_keys(char_u *args)
23322332
char *save_str = nb_unquote(args, NULL);
23332333
char *tok = strtok(save_str, " ");
23342334
char *sep;
2335-
char keybuf[64];
2335+
#define KEYBUFLEN 64
2336+
char keybuf[KEYBUFLEN];
23362337
char cmdbuf[256];
23372338

23382339
while (tok != NULL)
@@ -2359,10 +2360,13 @@ special_keys(char_u *args)
23592360
tok++;
23602361
}
23612362

2362-
strcpy(&keybuf[i], tok);
2363-
vim_snprintf(cmdbuf, sizeof(cmdbuf),
2364-
"<silent><%s> :nbkey %s<CR>", keybuf, keybuf);
2365-
do_map(0, (char_u *)cmdbuf, NORMAL, FALSE);
2363+
if (strlen(tok) + i < KEYBUFLEN)
2364+
{
2365+
strcpy(&keybuf[i], tok);
2366+
vim_snprintf(cmdbuf, sizeof(cmdbuf),
2367+
"<silent><%s> :nbkey %s<CR>", keybuf, keybuf);
2368+
do_map(0, (char_u *)cmdbuf, NORMAL, FALSE);
2369+
}
23662370
tok = strtok(NULL, " ");
23672371
}
23682372
vim_free(save_str);

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -764,6 +764,8 @@ static char *(features[]) =
764764

765765
static int included_patches[] =
766766
{ /* Add new patch number below this line */
767+
/**/
768+
213,
767769
/**/
768770
212,
769771
/**/

0 commit comments

Comments
 (0)