mirrors/zsh
1
0
Fork 0
mirror of git://git.code.sf.net/p/zsh/code synced 2025-09-10 12:40:58 +02:00
Code Releases Activity

36909: in getargs(), sanity-check the offsets for start and end of the requested words, in case of overflow

Browse source
This commit is contained in:
Barton E. Schaefer 2015-10-21 15:13:17 -07:00
parent b947789d7c
commit 5cb75f0d41
2 changed files with 19 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ChangeLog
View file

@ -1,5 +1,8 @@
2015-10-21 Barton E. Schaefer <schaefer@zsh.org>
* 36909: Src/hist.c: in getargs(), sanity-check the offsets for
start and end of the requested words, in case of overflow
* 36871: Functions/Zle/bracketed-paste-magic: move initial call
to "zle .bracketed-paste-magic" to occur earlier in the function

18
Src/hist.c
View file

@ -2254,7 +2254,7 @@ static char *
getargs(Histent elist, int arg1, int arg2)
{
short *words = elist->words;
int pos1, nwords = elist->nwords;
int pos1, pos2, nwords = elist->nwords;
if (arg2 < arg1 || arg1 >= nwords || arg2 >= nwords) {
/* remember, argN is indexed from 0, nwords is total no. of words */
@ -2263,8 +2263,22 @@ getargs(Histent elist, int arg1, int arg2)
return NULL;
}
/* optimization for accessing entire history event */
if (arg1 == 0 && arg2 == nwords - 1)
return dupstring(elist->node.nam);
pos1 = words[2*arg1];
return dupstrpfx(elist->node.nam + pos1, words[2*arg2+1] - pos1);
pos2 = words[2*arg2+1];
/* a word has to be at least one character long, so if the position
* of a word is less than its index, we've overflowed our signed
* short integer word range and the recorded position is garbage. */
if (pos1 < 0 || pos1 < arg1 || pos2 < 0 || pos2 < arg2) {
herrflush();
zerr("history event too long, can't index requested words");
return NULL;
}
return dupstrpfx(elist->node.nam + pos1, pos2 - pos1);
}
/**/