mirror of
https://github.com/neovim/neovim.git
synced 2024-12-26 14:11:15 -07:00
9e79f7433e
fix(usercmd): fix buffer overflow in uc_list() Build with: -Wp,-D_FORTIFY_SOURCE=3 -O1 and gcc 13. *** buffer overflow detected ***: terminated (gdb) bt #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 #1 0x00007f3eb8b93c03 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78 #2 0x00007f3eb8b42aee in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x00007f3eb8b2b87f in __GI_abort () at abort.c:79 #4 0x00007f3eb8b2c60f in __libc_message (fmt=fmt@entry=0x7f3eb8ca72e6 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:150 #5 0x00007f3eb8c27b29 in __GI___fortify_fail (msg=msg@entry=0x7f3eb8ca728c "buffer overflow detected") at fortify_fail.c:24 #6 0x00007f3eb8c26364 in __GI___chk_fail () at chk_fail.c:28 #7 0x00007f3eb8c25f45 in ___snprintf_chk (s=s@entry=0x55b8c7c096a5 <IObuff+5> "t' item", maxlen=maxlen@entry=1025, flag=flag@entry=2, slen=slen@entry=1020, format=format@entry=0x55b8c7b872a6 "%ldc") at snprintf_chk.c:29 #8 0x000055b8c7aea59f in snprintf (__fmt=0x55b8c7b872a6 "%ldc", __n=1025, __s=0x55b8c7c096a5 <IObuff+5> "t' item") at /usr/include/bits/stdio2.h:54 #9 uc_list (name=name@entry=0x55b8c8351788 "Explore", name_len=name_len@entry=7) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:534 #10 0x000055b8c7aeb8a0 in ex_command (eap=0x7fffdc350e60) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:1009 #11 0x000055b8c7972537 in execute_cmd0 (retv=retv@entry=0x7fffdc350e54, eap=eap@entry=0x7fffdc350e60, errormsg=errormsg@entry=0x7fffdc350e58, preview=preview@entry=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:1620 #12 0x000055b8c7975c55 in do_one_cmd (cmdlinep=cmdlinep@entry=0x7fffdc3510b8, flags=flags@entry=0, cstack=cstack@entry=0x7fffdc351140, fgetline=fgetline@entry=0x55b8c79882b8 <getexline>, cookie=cookie@entry=0x0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:2279 #13 0x000055b8c79767fe in do_cmdline (cmdline=<optimized out>, fgetline=0x55b8c79882b8 <getexline>, cookie=0x0, flags=0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:578 #14 0x000055b8c7a17463 in nv_colon (cap=0x7fffdc351780) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:3228 #15 0x000055b8c7a11b35 in normal_execute (state=0x7fffdc351700, key=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:1196 #16 0x000055b8c7ab0994 in state_enter (s=0x7fffdc351700) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/state.c:99 #17 0x000055b8c7a0ef68 in normal_enter (cmdwin=false, noexmode=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:497 #18 0x000055b8c78a0640 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/main.c:641
50 lines
2.0 KiB
Lua
50 lines
2.0 KiB
Lua
local helpers = require("test.functional.helpers")(after_each)
|
|
local command = helpers.command
|
|
local eq = helpers.eq
|
|
local clear = helpers.clear
|
|
local funcs = helpers.funcs
|
|
local pcall_err = helpers.pcall_err
|
|
local assert_alive = helpers.assert_alive
|
|
|
|
describe('Ex cmds', function()
|
|
before_each(function()
|
|
clear()
|
|
end)
|
|
|
|
it('handle integer overflow from user-input #5555', function()
|
|
command(':9999999999999999999999999999999999999999')
|
|
command(':later 9999999999999999999999999999999999999999')
|
|
command(':echo expand("#<9999999999999999999999999999999999999999")')
|
|
command(':lockvar 9999999999999999999999999999999999999999')
|
|
command(':winsize 9999999999999999999999999999999999999999 9999999999999999999999999999999999999999')
|
|
eq('Vim(tabnext):E475: Invalid argument: 9999999999999999999999999999999999999999',
|
|
pcall_err(command, ':tabnext 9999999999999999999999999999999999999999'))
|
|
eq('Vim(Next):E939: Positive count required',
|
|
pcall_err(command, ':N 9999999999999999999999999999999999999999'))
|
|
eq('Vim(menu):E329: No menu "9999999999999999999999999999999999999999"',
|
|
pcall_err(command, ':menu 9999999999999999999999999999999999999999'))
|
|
eq('Vim(bdelete):E939: Positive count required',
|
|
pcall_err(command, ':bdelete 9999999999999999999999999999999999999999'))
|
|
assert_alive()
|
|
end)
|
|
|
|
it('listing long user command does not crash', function()
|
|
command('execute "command" repeat("T", 255) ":"')
|
|
command('command')
|
|
end)
|
|
|
|
it(':def is an unknown command #23149', function()
|
|
eq('Vim:E492: Not an editor command: def', pcall_err(command, 'def'))
|
|
eq(1, funcs.exists(':d'))
|
|
eq('delete', funcs.fullcommand('d'))
|
|
eq(1, funcs.exists(':de'))
|
|
eq('delete', funcs.fullcommand('de'))
|
|
eq(0, funcs.exists(':def'))
|
|
eq('', funcs.fullcommand('def'))
|
|
eq(1, funcs.exists(':defe'))
|
|
eq('defer', funcs.fullcommand('defe'))
|
|
eq(2, funcs.exists(':defer'))
|
|
eq('defer', funcs.fullcommand('defer'))
|
|
end)
|
|
end)
|