patch 8.1.1143: may pass weird strings to file name expansion

Problem:    May pass weird strings to file name expansion.
Solution:   Check for matching characters.  Disallow control characters.

diff --git a/src/misc1.c b/src/misc1.c
index 54da8900e3be8bed70a5907570fbabfca9297079..3797094755fc1bdc769c98c0877a5fc357df4a03 100644 (file)
--- a/src/misc1.c
+++ b/src/misc1.c
@@ -6170,11 +6170,22 @@ has_special_wildchar(char_u *p)
 {
     for ( ; *p; MB_PTR_ADV(p))
     {
-       /* Allow for escaping. */
-       if (*p == '\\' && p[1] != NUL)
+       // Disallow line break characters.
+       if (*p == '\r' || *p == '\n')
+           break;
+       // Allow for escaping.
+       if (*p == '\\' && p[1] != NUL && p[1] != '\r' && p[1] != '\n')
            ++p;
        else if (vim_strchr((char_u *)SPECIAL_WILDCHAR, *p) != NULL)
+       {
+           // A { must be followed by a matching }.
+           if (*p == '{' && vim_strchr(p, '}') == NULL)
+               continue;
+           // A quote and backtick must be followed by another one.
+           if ((*p == '`' || *p == '\'') && vim_strchr(p, *p) == NULL)
+               continue;
            return TRUE;
+       }
     }
     return FALSE;
 }

diff --git a/src/option.c b/src/option.c
index 456439581fef5d8444676280aeaa5fdb2027fda2..e4b1d5f43d260a9ad5abe2fee5ab3624314cbd44 100644 (file)
--- a/src/option.c
+++ b/src/option.c
@@ -6006,20 +6006,39 @@ set_string_option(
 }
 
 /*
- * Return TRUE if "val" is a valid 'filetype' name.
- * Also used for 'syntax' and 'keymap'.
+ * Return TRUE if "val" is a valid name: only consists of alphanumeric ASCII
+ * characters or characters in "allowed".
  */
     static int
-valid_filetype(char_u *val)
+valid_name(char_u *val, char *allowed)
 {
     char_u *s;
 
     for (s = val; *s != NUL; ++s)
-       if (!ASCII_ISALNUM(*s) && vim_strchr((char_u *)".-_", *s) == NULL)
+       if (!ASCII_ISALNUM(*s) && vim_strchr((char_u *)allowed, *s) == NULL)
            return FALSE;
     return TRUE;
 }
 
+/*
+ * Return TRUE if "val" is a valid 'filetype' name.
+ * Also used for 'syntax' and 'keymap'.
+ */
+    static int
+valid_filetype(char_u *val)
+{
+    return valid_name(val, ".-_");
+}
+
+/*
+ * Return TRUE if "val" is a valid 'spellang' value.
+ */
+    int
+valid_spellang(char_u *val)
+{
+    return valid_name(val, ".-_,");
+}
+
 /*
  * Handle string options that need some action to perform when changed.
  * Returns NULL for success, or an error message for an error.
@@ -7082,7 +7101,10 @@ did_set_string_option(
     else if (varp == &(curwin->w_s->b_p_spl)
            || varp == &(curwin->w_s->b_p_spf))
     {
-       errmsg = did_set_spell_option(varp == &(curwin->w_s->b_p_spf));
+       if (!valid_spellang(*varp))
+           errmsg = e_invarg;
+       else
+           errmsg = did_set_spell_option(varp == &(curwin->w_s->b_p_spf));
     }
     /* When 'spellcapcheck' is set compile the regexp program. */
     else if (varp == &(curwin->w_s->b_p_spc))
@@ -7737,7 +7759,8 @@ did_set_string_option(
                    break;
            if (p > q)
            {
-               vim_snprintf((char *)fname, 200, "spell/%.*s.vim", (int)(p - q), q);
+               vim_snprintf((char *)fname, 200, "spell/%.*s.vim",
+                                                             (int)(p - q), q);
                source_runtime(fname, DIP_ALL);
            }
        }

diff --git a/src/proto/option.pro b/src/proto/option.pro
index 1027edf68c76f219b6e78dbdb1bb04435956be1c..15aa0102e157228e11b127b2315483b133e43907 100644 (file)
--- a/src/proto/option.pro
+++ b/src/proto/option.pro
@@ -21,6 +21,7 @@ int get_term_opt_idx(char_u **p);
 int set_term_option_alloced(char_u **p);
 int was_set_insecurely(char_u *opt, int opt_flags);
 void set_string_option_direct(char_u *name, int opt_idx, char_u *val, int opt_flags, int set_sid);
+int valid_spellang(char_u *val);
 char *check_colorcolumn(win_T *wp);
 char *check_stl_option(char_u *s);
 void set_term_option_sctx_idx(char *name, int opt_idx);

diff --git a/src/spell.c b/src/spell.c
index ae4db12c04ae46be450fcbef92c203ccbdd1dada..947bee518715be08f784a2c3db76888124c4fc70 100644 (file)
--- a/src/spell.c
+++ b/src/spell.c
@@ -2308,11 +2308,14 @@ did_set_spelllang(win_T *wp)
     /* Loop over comma separated language names. */
     for (splp = spl_copy; *splp != NUL; )
     {
-       /* Get one language name. */
+       // Get one language name.
        copy_option_part(&splp, lang, MAXWLEN, ",");
        region = NULL;
        len = (int)STRLEN(lang);
 
+       if (!valid_spellang(lang))
+           continue;
+
        if (STRCMP(lang, "cjk") == 0)
        {
            wp->w_s->b_cjk = 1;

diff --git a/src/testdir/test_escaped_glob.vim b/src/testdir/test_escaped_glob.vim
index 880f32eca4909fe18a32e1e946418358b364bbeb..a03c18047cce7c99a999c27079c70625894b7943 100644 (file)
--- a/src/testdir/test_escaped_glob.vim
+++ b/src/testdir/test_escaped_glob.vim
@@ -17,7 +17,7 @@ function Test_glob()
   " Setting 'shell' to an invalid name causes a memory leak.
   sandbox call assert_equal("", glob('Xxx\{'))
   sandbox call assert_equal("", glob('Xxx\$'))
-  w! Xxx{
+  w! Xxx\{
   w! Xxx\$
   sandbox call assert_equal("Xxx{", glob('Xxx\{'))
   sandbox call assert_equal("Xxx$", glob('Xxx\$'))

diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
index 76ad12e4c0e0bba5634b88f1d0840c970e558fec..6bf43ac3fbc417b3e545c9ea6ba9b7952922881a 100644 (file)
--- a/src/testdir/test_spell.vim
+++ b/src/testdir/test_spell.vim
@@ -149,6 +149,12 @@ func Test_spellinfo()
   set nospell spelllang=en
   call assert_fails('spellinfo', 'E756:')
 
+  call assert_fails('set spelllang=foo/bar', 'E474:')
+  call assert_fails('set spelllang=foo\ bar', 'E474:')
+  call assert_fails("set spelllang=foo\\\nbar", 'E474:')
+  call assert_fails("set spelllang=foo\\\rbar", 'E474:')
+  call assert_fails("set spelllang=foo+bar", 'E474:')
+
   set enc& spell& spelllang&
   bwipe
 endfunc

diff --git a/src/version.c b/src/version.c
index a9e4ccf74400cd32959de5ec707cb4bdcad21015..3e0e95f41d0f4c3123154d1bbb86fa4010d14bf8 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -771,6 +771,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1143,
 /**/
     1142,
 /**/