To: vim-dev@vim.org Subject: Patch 7.1.174 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit ------------ Patch 7.1.174 Problem: Writing NUL past end of a buffer. Solution: Copy one byte less when using strncat(). (Dominuque Pelle) Files: src/ex_cmds.c, src/ex_docmd.c *** ../vim-7.1.173/src/ex_cmds.c Sat Dec 8 22:20:24 2007 --- src/ex_cmds.c Fri Dec 7 22:13:32 2007 *************** *** 1650,1656 **** { vim_snprintf((char *)IObuff, IOSIZE, _("%sviminfo: %s in line: "), errnum, message); ! STRNCAT(IObuff, line, IOSIZE - STRLEN(IObuff)); if (IObuff[STRLEN(IObuff) - 1] == '\n') IObuff[STRLEN(IObuff) - 1] = NUL; emsg(IObuff); --- 1650,1656 ---- { vim_snprintf((char *)IObuff, IOSIZE, _("%sviminfo: %s in line: "), errnum, message); ! STRNCAT(IObuff, line, IOSIZE - STRLEN(IObuff) - 1); if (IObuff[STRLEN(IObuff) - 1] == '\n') IObuff[STRLEN(IObuff) - 1] = NUL; emsg(IObuff); *** ../vim-7.1.173/src/ex_docmd.c Sat Nov 24 21:49:19 2007 --- src/ex_docmd.c Fri Dec 7 21:01:03 2007 *************** *** 2660,2666 **** errormsg = IObuff; } STRCAT(errormsg, ": "); ! STRNCAT(errormsg, *cmdlinep, IOSIZE - STRLEN(IObuff)); } emsg(errormsg); } --- 2660,2666 ---- errormsg = IObuff; } STRCAT(errormsg, ": "); ! STRNCAT(errormsg, *cmdlinep, IOSIZE - STRLEN(IObuff) - 1); } emsg(errormsg); } *** ../vim-7.1.173/src/version.c Sun Dec 9 19:25:35 2007 --- src/version.c Sun Dec 9 19:36:50 2007 *************** *** 668,669 **** --- 668,671 ---- { /* Add new patch number below this line */ + /**/ + 174, /**/ -- hundred-and-one symptoms of being an internet addict: 214. Your MCI "Circle of Friends" are all Hayes-compatible. /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\ \\\ download, build and distribute -- http://www.A-A-P.org /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///