commit e01e5215f927f83778ad7494abb0007aa52d08c3
author Bram Moolenaar <Bram@vim.org> Sun Jan 08 20:31:18 2023 +0000
committer Bram Moolenaar <Bram@vim.org> Sun Jan 08 20:31:18 2023 +0000
tree 733b0428f47732fcc2cf83ce583aa62d622961b6
parent 8367716a6e9589d61a771e6c329da05c9b55e61a

patch 9.0.1160: ASAN error for ufunc_T allocated with wrong size

Problem:    ASAN error for ufunc_T allocated with wrong size.
Solution:   Make sure the size can always fit the struct.

src/userfunc.c

diff --git a/src/userfunc.c b/src/userfunc.c
index 9ac3a44..bdec34d 100644
--- a/src/userfunc.c
+++ b/src/userfunc.c
@@ -641,6 +641,19 @@
     return name;
 }
 
+/*
+ * Allocate a "ufunc_T" for a function called "name".
+ * Makes sure the size is right.
+ */
+    static ufunc_T *
+alloc_ufunc(char_u *name)
+{
+    // When the name is short we need to make sure we allocate enough bytes for
+    // the whole struct, including any padding.
+    size_t len = offsetof(ufunc_T, uf_name) + STRLEN(name) + 1;
+    return alloc_clear(len < sizeof(ufunc_T) ? sizeof(ufunc_T) : len);
+}
+
 #if defined(FEAT_LUA) || defined(PROTO)
 /*
  * Registers a native C callback which can be called from Vim script.
@@ -652,7 +665,7 @@
     char_u	*name = get_lambda_name();
     ufunc_T	*fp;
 
-    fp = alloc_clear(offsetof(ufunc_T, uf_name) + STRLEN(name) + 1);
+    fp = alloc_ufunc(name);
     if (fp == NULL)
 	return NULL;
 
@@ -1356,7 +1369,7 @@
     }
 
     name = get_lambda_name();
-    ufunc = alloc_clear(offsetof(ufunc_T, uf_name) + STRLEN(name) + 1);
+    ufunc = alloc_ufunc(name);
     if (ufunc == NULL)
 	goto erret;
     set_ufunc_name(ufunc, name);
@@ -1557,7 +1570,7 @@
 	char_u	    *line_end;
 	char_u	    *name = get_lambda_name();
 
-	fp = alloc_clear(offsetof(ufunc_T, uf_name) + STRLEN(name) + 1);
+	fp = alloc_ufunc(name);
 	if (fp == NULL)
 	    goto errret;
 	fp->uf_def_status = UF_NOT_COMPILED;
@@ -2558,7 +2571,7 @@
 	return FAIL;
     }
 
-    fp = alloc_clear(offsetof(ufunc_T, uf_name) + STRLEN(global) + 1);
+    fp = alloc_ufunc(global);
     if (fp == NULL)
 	return FAIL;
 
@@ -5081,7 +5094,7 @@
 	    }
 	}
 
-	fp = alloc_clear(offsetof(ufunc_T, uf_name) + STRLEN(name) + 1);
+	fp = alloc_ufunc(name);
 	if (fp == NULL)
 	    goto erret;
 	fp_allocated = TRUE;
@@ -5525,10 +5538,7 @@
     ufunc_T *
 copy_function(ufunc_T *fp)
 {
-    // The struct may have padding, make sure we allocate at least the size of
-    // the struct.
-    size_t len = offsetof(ufunc_T, uf_name) + STRLEN(fp->uf_name) + 1;
-    ufunc_T *ufunc = alloc_clear(len < sizeof(ufunc_T) ? sizeof(ufunc_T) : len);
+    ufunc_T *ufunc = alloc_ufunc(fp->uf_name);
     if (ufunc == NULL)
 	return NULL;