patch 8.2.4752: wrong 'statusline' value can cause illegal memory access

Problem:    Wrong 'statusline' value can cause illegal memory access.
Solution:   Properly check the value. (closes #10192)

diff --git a/src/optionstr.c b/src/optionstr.c
index 3de23ba0490764f339b92b8de2e007bb2feab8f8..7f130ddf8752b38ff001006405550695c3a5fa8a 100644 (file)
--- a/src/optionstr.c
+++ b/src/optionstr.c
@@ -574,7 +574,7 @@ valid_filetype(char_u *val)
 #ifdef FEAT_STL_OPT
 /*
  * Check validity of options with the 'statusline' format.
- * Return error message or NULL.
+ * Return an untranslated error message or NULL.
  */
     static char *
 check_stl_option(char_u *s)
@@ -625,17 +625,19 @@ check_stl_option(char_u *s)
        }
        if (*s == '{')
        {
-           int reevaluate = (*s == '%');
+           int reevaluate = (*++s == '%');
 
-           s++;
+           if (reevaluate && *++s == '}')
+               // "}" is not allowed immediately after "%{%"
+               return illegal_char(errbuf, '}');
            while ((*s != '}' || (reevaluate && s[-1] != '%')) && *s)
                s++;
            if (*s != '}')
-               return N_(e_unclosed_expression_sequence);
+               return e_unclosed_expression_sequence;
        }
     }
     if (groupdepth != 0)
-       return N_(e_unbalanced_groups);
+       return e_unbalanced_groups;
     return NULL;
 }
 #endif
@@ -1805,8 +1807,8 @@ ambw_end:
     }
 
 #ifdef FEAT_STL_OPT
-    // 'statusline' or 'rulerformat'
-    else if (gvarp == &p_stl || varp == &p_ruf)
+    // 'statusline', 'tabline' or 'rulerformat'
+    else if (gvarp == &p_stl || varp == &p_tal || varp == &p_ruf)
     {
        int wid;
 
@@ -1824,7 +1826,7 @@ ambw_end:
            else
                errmsg = check_stl_option(p_ruf);
        }
-       // check 'statusline' only if it doesn't start with "%!"
+       // check 'statusline' or 'tabline' only if it doesn't start with "%!"
        else if (varp == &p_ruf || s[0] != '%' || s[1] != '!')
            errmsg = check_stl_option(s);
        if (varp == &p_ruf && errmsg == NULL)

diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
index 81081f5020d9dc30067c3817e9cfc12a3f877ced..e49afae1742aeb0d7ed8cf6557cade2dfae97fb5 100644 (file)
--- a/src/testdir/test_options.vim
+++ b/src/testdir/test_options.vim
@@ -392,8 +392,16 @@ func Test_set_errors()
   call assert_fails('set rulerformat=%15(%%', 'E542:')
   call assert_fails('set statusline=%$', 'E539:')
   call assert_fails('set statusline=%{', 'E540:')
+  call assert_fails('set statusline=%{%', 'E540:')
+  call assert_fails('set statusline=%{%}', 'E539:')
   call assert_fails('set statusline=%(', 'E542:')
   call assert_fails('set statusline=%)', 'E542:')
+  call assert_fails('set tabline=%$', 'E539:')
+  call assert_fails('set tabline=%{', 'E540:')
+  call assert_fails('set tabline=%{%', 'E540:')
+  call assert_fails('set tabline=%{%}', 'E539:')
+  call assert_fails('set tabline=%(', 'E542:')
+  call assert_fails('set tabline=%)', 'E542:')
 
   if has('cursorshape')
     " This invalid value for 'guicursor' used to cause Vim to crash.

diff --git a/src/version.c b/src/version.c
index db82785164bec64b839367b58fbbf45626ba7867..c622f778a6cda92c919b2e97b9d7c51ae3f9a0cd 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -746,6 +746,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4752,
 /**/
     4751,
 /**/