commit 7c94ce910f07e0d76d66b46bccfe39a07d8e1f6d
author Bram Moolenaar <Bram@vim.org> Mon Apr 13 14:45:27 2015 +0200
committer Bram Moolenaar <Bram@vim.org> Mon Apr 13 14:45:27 2015 +0200
tree 70cff5bf8abb1250cd8921ce3d2762312bbcc402
parent 83d1b19015219c7799af0a0d539ae86a41057240

patch 7.4.695
Problem:    Out-of-bounds read, dectected by Coverity.
Solution:   Remember the value of cmap for the first matching encoding.  Reset
            cmap to that value if first matching encoding is going to be used.
            (Eliseo Martínez)

src/hardcopy.c

diff --git a/src/hardcopy.c b/src/hardcopy.c
index 95a367d..b2e400f 100644
--- a/src/hardcopy.c
+++ b/src/hardcopy.c
@@ -2513,13 +2513,18 @@
     props = enc_canon_props(p_encoding);
     if (!(props & ENC_8BIT) && ((*p_pmcs != NUL) || !(props & ENC_UNICODE)))
     {
+	int cmap_first;
+
 	p_mbenc_first = NULL;
 	for (cmap = 0; cmap < (int)NUM_ELEMENTS(prt_ps_mbfonts); cmap++)
 	    if (prt_match_encoding((char *)p_encoding, &prt_ps_mbfonts[cmap],
 								    &p_mbenc))
 	    {
 		if (p_mbenc_first == NULL)
+		{
 		    p_mbenc_first = p_mbenc;
+		    cmap_first = cmap;
+		}
 		if (prt_match_charset((char *)p_pmcs, &prt_ps_mbfonts[cmap],
 								   &p_mbchar))
 		    break;
@@ -2527,7 +2532,10 @@
 
 	/* Use first encoding matched if no charset matched */
 	if (p_mbchar == NULL && p_mbenc_first != NULL)
+	{
 	    p_mbenc = p_mbenc_first;
+	    cmap = cmap_first;
+	}
     }
 
     prt_out_mbyte = (p_mbenc != NULL);

src/version.c

diff --git a/src/version.c b/src/version.c
index 5601c01..4cbf4b6 100644
--- a/src/version.c
+++ b/src/version.c
@@ -742,6 +742,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    695,
+/**/
     694,
 /**/
     693,