commit 652dee448618589de5528a9e9a36995803f5557a
author Bram Moolenaar <Bram@vim.org> Fri Jan 28 20:47:49 2022 +0000
committer Bram Moolenaar <Bram@vim.org> Fri Jan 28 20:47:49 2022 +0000
tree a659b1d0a7f5409943f2c626e2a87cde520c3733
parent 14cbf77845624e4bfc28a65a5debb81864cba2cf

patch 8.2.4245: ":retab 0" may cause illegal memory access

Problem:    ":retab 0" may cause illegal memory access.
Solution:   Limit the value of 'tabstop' to 10000.

src/option.c

diff --git a/src/option.c b/src/option.c
index bb952fe..482e960 100644
--- a/src/option.c
+++ b/src/option.c
@@ -3752,6 +3752,11 @@
 	errmsg = e_argument_must_be_positive;
 	curbuf->b_p_ts = 8;
     }
+    else if (curbuf->b_p_ts > TABSTOP_MAX)
+    {
+	errmsg = e_invalid_argument;
+	curbuf->b_p_ts = 8;
+    }
     if (p_tm < 0)
     {
 	errmsg = e_argument_must_be_positive;
@@ -5983,7 +5988,7 @@
 	    if (p_vsts && p_vsts != empty_option)
 		(void)tabstop_set(p_vsts, &buf->b_p_vsts_array);
 	    else
-		buf->b_p_vsts_array = 0;
+		buf->b_p_vsts_array = NULL;
 	    buf->b_p_vsts_nopaste = p_vsts_nopaste
 				 ? vim_strsave(p_vsts_nopaste) : NULL;
 #endif
@@ -6803,9 +6808,7 @@
 	    if (buf->b_p_vsts)
 		free_string_option(buf->b_p_vsts);
 	    buf->b_p_vsts = empty_option;
-	    if (buf->b_p_vsts_array)
-		vim_free(buf->b_p_vsts_array);
-	    buf->b_p_vsts_array = 0;
+	    VIM_CLEAR(buf->b_p_vsts_array);
 #endif
 	}
 
@@ -6851,12 +6854,11 @@
 		free_string_option(buf->b_p_vsts);
 	    buf->b_p_vsts = buf->b_p_vsts_nopaste
 			 ? vim_strsave(buf->b_p_vsts_nopaste) : empty_option;
-	    if (buf->b_p_vsts_array)
-		vim_free(buf->b_p_vsts_array);
+	    vim_free(buf->b_p_vsts_array);
 	    if (buf->b_p_vsts && buf->b_p_vsts != empty_option)
 		(void)tabstop_set(buf->b_p_vsts, &buf->b_p_vsts_array);
 	    else
-		buf->b_p_vsts_array = 0;
+		buf->b_p_vsts_array = NULL;
 #endif
 	}