patch 8.0.1421: accessing invalid memory with overlong byte sequence
Problem: Accessing invalid memory with overlong byte sequence.
Solution: Check for NUL character. (test by Dominique Pelle, closes #2485)
diff --git a/src/misc2.c b/src/misc2.c
index 460ea74..66aeee0 100644
--- a/src/misc2.c
+++ b/src/misc2.c
@@ -1622,11 +1622,17 @@
char_u *s;
c = utf_ptr2char(p);
+ l = utf_ptr2len(p);
+ if (c == 0)
+ {
+ /* overlong sequence, use only the first byte */
+ c = *p;
+ l = 1;
+ }
uc = utf_toupper(c);
/* Reallocate string when byte count changes. This is rare,
* thus it's OK to do another malloc()/free(). */
- l = utf_ptr2len(p);
newl = utf_char2len(uc);
if (newl != l)
{
@@ -1685,11 +1691,17 @@
char_u *s;
c = utf_ptr2char(p);
+ l = utf_ptr2len(p);
+ if (c == 0)
+ {
+ /* overlong sequence, use only the first byte */
+ c = *p;
+ l = 1;
+ }
lc = utf_tolower(c);
/* Reallocate string when byte count changes. This is rare,
* thus it's OK to do another malloc()/free(). */
- l = utf_ptr2len(p);
newl = utf_char2len(lc);
if (newl != l)
{
diff --git a/src/testdir/test_functions.vim b/src/testdir/test_functions.vim
index 20e4280..ffc3bc3 100644
--- a/src/testdir/test_functions.vim
+++ b/src/testdir/test_functions.vim
@@ -268,6 +268,11 @@
" Ⱥ (U+023A) and Ⱦ (U+023E) are the *only* code points to increase
" in length (2 to 3 bytes) when lowercased. So let's test them.
call assert_equal("ⱥ ⱦ", tolower("Ⱥ Ⱦ"))
+
+ " This call to tolower with invalid utf8 sequence used to cause access to
+ " invalid memory.
+ call tolower("\xC0\x80\xC0")
+ call tolower("123\xC0\x80\xC0")
endfunc
func Test_toupper()
@@ -338,6 +343,11 @@
call assert_equal("ZŹŻŽƵẐẔ", toupper("ZŹŻŽƵẐẔ"))
call assert_equal("Ⱥ Ⱦ", toupper("ⱥ ⱦ"))
+
+ " This call to toupper with invalid utf8 sequence used to cause access to
+ " invalid memory.
+ call toupper("\xC0\x80\xC0")
+ call toupper("123\xC0\x80\xC0")
endfunc
" Tests for the mode() function
diff --git a/src/version.c b/src/version.c
index 1a217e7..943469f 100644
--- a/src/version.c
+++ b/src/version.c
@@ -772,6 +772,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 1421,
+/**/
1420,
/**/
1419,