To: vim_dev@googlegroups.com
Subject: Patch 8.0.0212
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 8.0.0212
Problem:    The buffer used to store a key name theoreticaly could be too
            small. (Coverity)
Solution:   Count all possible modifier characters.  Add a check for the
            length just in case.
Files:      src/keymap.h, src/misc2.c


*** ../vim-8.0.0211/src/keymap.h	2017-01-21 20:04:17.562757816 +0100
--- src/keymap.h	2017-01-22 14:48:17.014376869 +0100
***************
*** 482,490 ****
  
  /*
   * The length of the longest special key name, including modifiers.
!  * Current longest is <M-C-S-T-4-MiddleRelease> (length includes '<' and '>').
   */
! #define MAX_KEY_NAME_LEN    25
  
  /* Maximum length of a special key event as tokens.  This includes modifiers.
   * The longest event is something like <M-C-S-T-4-LeftDrag> which would be the
--- 482,491 ----
  
  /*
   * The length of the longest special key name, including modifiers.
!  * Current longest is <M-C-S-T-D-A-4-ScrollWheelRight> (length includes '<' and
!  * '>').
   */
! #define MAX_KEY_NAME_LEN    32
  
  /* Maximum length of a special key event as tokens.  This includes modifiers.
   * The longest event is something like <M-C-S-T-4-LeftDrag> which would be the
*** ../vim-8.0.0211/src/misc2.c	2017-01-21 20:04:17.562757816 +0100
--- src/misc2.c	2017-01-22 15:05:01.588040025 +0100
***************
*** 2162,2167 ****
--- 2162,2168 ----
      /* 'A' must be the last one */
      {MOD_MASK_ALT,		MOD_MASK_ALT,		(char_u)'A'},
      {0, 0, NUL}
+     /* NOTE: when adding an entry, update MAX_KEY_NAME_LEN! */
  };
  
  /*
***************
*** 2431,2436 ****
--- 2432,2438 ----
      {K_PLUG,		(char_u *)"Plug"},
      {K_CURSORHOLD,	(char_u *)"CursorHold"},
      {0,			NULL}
+     /* NOTE: When adding a long name update MAX_KEY_NAME_LEN. */
  };
  
  #define KEY_NAMES_TABLE_LEN (sizeof(key_names_table) / sizeof(struct key_name_entry))
***************
*** 2659,2666 ****
      }
      else		/* use name of special key */
      {
! 	STRCPY(string + idx, key_names_table[table_idx].name);
! 	idx = (int)STRLEN(string);
      }
      string[idx++] = '>';
      string[idx] = NUL;
--- 2661,2673 ----
      }
      else		/* use name of special key */
      {
! 	size_t len = STRLEN(key_names_table[table_idx].name);
! 
! 	if (len + idx + 2 <= MAX_KEY_NAME_LEN)
! 	{
! 	    STRCPY(string + idx, key_names_table[table_idx].name);
! 	    idx += (int)len;
! 	}
      }
      string[idx++] = '>';
      string[idx] = NUL;
*** ../vim-8.0.0211/src/version.c	2017-01-21 22:49:56.142666237 +0100
--- src/version.c	2017-01-22 15:03:49.780492910 +0100
***************
*** 766,767 ****
--- 766,769 ----
  {   /* Add new patch number below this line */
+ /**/
+     212,
  /**/

-- 
You had connectors?  Eeee, when I were a lad we 'ad to carry the
bits between the computer and the terminal with a spoon...

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///