patch 8.0.0493: crash with cd command with very long argument
Problem: Crash with cd command with very long argument.
Solution: Check for running out of space. (Dominique pending, closes #1576)
diff --git a/src/misc2.c b/src/misc2.c
index 357511d..2ded997 100644
--- a/src/misc2.c
+++ b/src/misc2.c
@@ -4637,13 +4637,23 @@
if (!vim_isAbsName(stackp->ffs_fix_path)
&& search_ctx->ffsc_start_dir)
{
- STRCPY(file_path, search_ctx->ffsc_start_dir);
- add_pathsep(file_path);
+ if (STRLEN(search_ctx->ffsc_start_dir) + 1 < MAXPATHL)
+ {
+ STRCPY(file_path, search_ctx->ffsc_start_dir);
+ add_pathsep(file_path);
+ }
+ else
+ goto fail;
}
/* append the fix part of the search path */
- STRCAT(file_path, stackp->ffs_fix_path);
- add_pathsep(file_path);
+ if (STRLEN(file_path) + STRLEN(stackp->ffs_fix_path) + 1 < MAXPATHL)
+ {
+ STRCAT(file_path, stackp->ffs_fix_path);
+ add_pathsep(file_path);
+ }
+ else
+ goto fail;
#ifdef FEAT_PATH_EXTRA
rest_of_wildcards = stackp->ffs_wc_path;
@@ -4660,7 +4670,10 @@
if (*p > 0)
{
(*p)--;
- file_path[len++] = '*';
+ if (len + 1 < MAXPATHL)
+ file_path[len++] = '*';
+ else
+ goto fail;
}
if (*p == 0)
@@ -4688,7 +4701,10 @@
*/
while (*rest_of_wildcards
&& !vim_ispathsep(*rest_of_wildcards))
- file_path[len++] = *rest_of_wildcards++;
+ if (len + 1 < MAXPATHL)
+ file_path[len++] = *rest_of_wildcards++;
+ else
+ goto fail;
file_path[len] = NUL;
if (vim_ispathsep(*rest_of_wildcards))
@@ -4749,9 +4765,15 @@
/* prepare the filename to be checked for existence
* below */
- STRCPY(file_path, stackp->ffs_filearray[i]);
- add_pathsep(file_path);
- STRCAT(file_path, search_ctx->ffsc_file_to_search);
+ if (STRLEN(stackp->ffs_filearray[i]) + 1
+ + STRLEN(search_ctx->ffsc_file_to_search) < MAXPATHL)
+ {
+ STRCPY(file_path, stackp->ffs_filearray[i]);
+ add_pathsep(file_path);
+ STRCAT(file_path, search_ctx->ffsc_file_to_search);
+ }
+ else
+ goto fail;
/*
* Try without extra suffix and then with suffixes
@@ -4924,9 +4946,15 @@
if (*search_ctx->ffsc_start_dir == 0)
break;
- STRCPY(file_path, search_ctx->ffsc_start_dir);
- add_pathsep(file_path);
- STRCAT(file_path, search_ctx->ffsc_fix_path);
+ if (STRLEN(search_ctx->ffsc_start_dir) + 1
+ + STRLEN(search_ctx->ffsc_fix_path) < MAXPATHL)
+ {
+ STRCPY(file_path, search_ctx->ffsc_start_dir);
+ add_pathsep(file_path);
+ STRCAT(file_path, search_ctx->ffsc_fix_path);
+ }
+ else
+ goto fail;
/* create a new stack entry */
sptr = ff_create_stack_element(file_path,
@@ -4940,6 +4968,7 @@
}
#endif
+fail:
vim_free(file_path);
return NULL;
}