[vim/vim] Check for printf argument overflow (PR #13799)

36 views
Skip to first unread message

cvwillegen

unread,
Dec 29, 2023, 5:35:46 AM12/29/23
to vim/vim, Subscribed

Check arguments for the printf function if the width or positional argument will overflow.

You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/13799

Commit Summary

  • 31de2f1 Check message formatting function for overflow.
  • a0c0ef5 Fix compiler warnings, smarter testing, code clean up.
  • c1a18b6 Fix argument type.
  • c0ec5c2 Merge branch 'vim:master' into check-for-printf-argument-overflow
  • f25be7a Merge branch 'vim:master' into check-for-printf-argument-overflow

File Changes

(2 files)

Patch Links:

—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/13799@github.com>

Christian Brabandt

unread,
Dec 29, 2023, 10:31:47 AM12/29/23
to vim/vim, Subscribed

thanks. I'll move this to after the vim 9.1 release however

—
Reply to this email directly, view it on GitHub.

You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/13799/c1872170810@github.com>

Christian Brabandt

unread,
Jan 3, 2024, 12:15:45 PM1/3/24
to vim/vim, Subscribed

what is the magic 6400 here used? Can we make this a define and add a short description why it is 6400?

—
Reply to this email directly, view it on GitHub.

You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/13799/c1875703635@github.com>

cvwillegen

unread,
Feb 29, 2024, 8:48:55 AM2/29/24
to vim/vim, Push

@cvwillegen pushed 3 commits.

  • 23d8680 Consolidate code into helper function. More testing.
  • 3857615 Merge branch 'check-for-printf-argument-overflow' of github.com:cvwillegen/vim into check-for-printf-argument-overflow
  • dacd3d8 Merge branch 'master' into check-for-printf-argument-overflow

—
View it on GitHub.
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/13799/push/17326995958@github.com>

Christian Brabandt

unread,
Mar 9, 2024, 12:06:04 PM3/9/24
to vim/vim, Subscribed

is this ready now?

—
Reply to this email directly, view it on GitHub.

You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/13799/c1986918625@github.com>

Christ van Willegen

unread,
Mar 10, 2024, 9:56:53 AM3/10/24
to vim...@googlegroups.com, reply+ACY5DGB5CR6JQ2P7HL...@reply.github.com


On Sat, Mar 9, 2024 at 6:06 PM Christian Brabandt <vim-dev...@256bit.org> wrote:

is this ready now?


Yes. Or at least, ready for review :-)

Christ van Willegen

vim-dev ML

unread,
Mar 10, 2024, 9:57:21 AM3/10/24
to vim/vim, vim-dev ML, Your activity

On Sat, Mar 9, 2024 at 6:06 PM Christian Brabandt ***@***.***>
wrote:

> is this ready now?
>

Yes. Or at least, ready for review :-)

Christ van Willegen

—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/13799/c1987241856@github.com>

Christian Brabandt

unread,
Mar 11, 2024, 5:19:09 PM3/11/24
to vim/vim, vim-dev ML, Comment

@chrisbra commented on this pull request.

In src/strings.c:

> +    const char **p,
+    unsigned int *uj)
+{
+    *uj = **p - '0';
+    ++*p;
+
+    while (VIM_ISDIGIT((int)(**p)) && *uj < MAX_ALLOWED_STRING_WIDTH)
+    {
+	*uj = 10 * *uj + (unsigned int)(**p - '0');
+	++*p;
+    }
+
+    if (*uj > MAX_ALLOWED_STRING_WIDTH)
+    {
+	format_overflow_error(pstart);
+	return -1;

return FAIL

—
Reply to this email directly, view it on GitHub.

You are receiving this because you commented.Message ID: <vim/vim/pull/13799/review/1929338963@github.com>

Christian Brabandt

unread,
Mar 11, 2024, 5:19:19 PM3/11/24
to vim/vim, vim-dev ML, Comment

@chrisbra commented on this pull request.

In src/strings.c:

> +    *uj = **p - '0';
+    ++*p;
+
+    while (VIM_ISDIGIT((int)(**p)) && *uj < MAX_ALLOWED_STRING_WIDTH)
+    {
+	*uj = 10 * *uj + (unsigned int)(**p - '0');
+	++*p;
+    }
+
+    if (*uj > MAX_ALLOWED_STRING_WIDTH)
+    {
+	format_overflow_error(pstart);
+	return -1;
+    }
+
+    return 0;

return OK;

—
Reply to this email directly, view it on GitHub.

You are receiving this because you commented.Message ID: <vim/vim/pull/13799/review/1929339780@github.com>

Christian Brabandt

unread,
Mar 11, 2024, 5:19:35 PM3/11/24
to vim/vim, vim-dev ML, Comment

@chrisbra commented on this pull request.

In src/strings.c:

> @@ -2531,10 +2581,11 @@ parse_fmt_types(
 		}
 
 		// Positional argument
-		unsigned int uj = *p++ - '0';
+		unsigned int uj;
+
+		if (get_unsigned_int(pstart, &p, &uj) == -1)

== FAIL

—
Reply to this email directly, view it on GitHub.

You are receiving this because you commented.Message ID: <vim/vim/pull/13799/review/1929340750@github.com>

Christian Brabandt

unread,
Mar 11, 2024, 5:19:54 PM3/11/24
to vim/vim, vim-dev ML, Comment

@chrisbra commented on this pull request.

In src/strings.c:

>  
-		    while (VIM_ISDIGIT((int)(*p)))
-			uj = 10 * uj + (unsigned int)(*p++ - '0');
+		    if (get_unsigned_int(arg + 1, &p, &uj) == -1)

== FAIL

—


Reply to this email directly, view it on GitHub.

You are receiving this because you commented.Message ID: <vim/vim/pull/13799/review/1929341695@github.com>

Christian Brabandt

unread,
Mar 11, 2024, 5:20:06 PM3/11/24
to vim/vim, vim-dev ML, Comment

@chrisbra commented on this pull request.

In src/strings.c:

>  
-		while (VIM_ISDIGIT((int)(*p)))
-		    uj = 10 * uj + (unsigned int)(*p++ - '0');
+		if (get_unsigned_int(digstart, &p, &uj) == -1)

same here

—
Reply to this email directly, view it on GitHub.

You are receiving this because you commented.Message ID: <vim/vim/pull/13799/review/1929342263@github.com>

Christian Brabandt

unread,
Mar 11, 2024, 5:20:15 PM3/11/24
to vim/vim, vim-dev ML, Comment

@chrisbra commented on this pull request.

In src/strings.c:

>  
-			while (VIM_ISDIGIT((int)(*p)))
-			    uj = 10 * uj + (unsigned int)(*p++ - '0');
+			if (get_unsigned_int(arg + 1, &p, &uj) == -1)

and here

—
Reply to this email directly, view it on GitHub.

You are receiving this because you commented.Message ID: <vim/vim/pull/13799/review/1929342705@github.com>

Christian Brabandt

unread,
Mar 11, 2024, 5:21:44 PM3/11/24
to vim/vim, vim-dev ML, Comment

a left a few comments, please change the return value from 0/-1 to OK/FAIL instead.

—
Reply to this email directly, view it on GitHub.

You are receiving this because you commented.Message ID: <vim/vim/pull/13799/c1989466512@github.com>

cvwillegen

unread,
Mar 14, 2024, 9:43:09 AM3/14/24
to vim/vim, vim-dev ML, Push

@cvwillegen pushed 1 commit.

  • 6c41899 Change return value from 0/-1 to OK/FAIL.

—
View it on GitHub.
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/13799/push/17543743273@github.com>

Christian Brabandt

unread,
Mar 14, 2024, 2:03:23 PM3/14/24
to vim/vim, vim-dev ML, Comment

Closed #13799 via c35fc03.

—
Reply to this email directly, view it on GitHub.

You are receiving this because you commented.Message ID: <vim/vim/pull/13799/issue_event/12122101706@github.com>

Christian Brabandt

unread,
Mar 14, 2024, 2:03:35 PM3/14/24
to vim/vim, vim-dev ML, Comment

thanks. Let me include it.

—
Reply to this email directly, view it on GitHub.

You are receiving this because you commented.Message ID: <vim/vim/pull/13799/c1998036658@github.com>

Reply all
Reply to author
Forward
0 new messages