patch 8.0.0370: invalid memory access when setting wildchar empty

Problem:    Invalid memory access when setting wildchar empty.
Solution:   Avoid going over the end of the option value. (Dominique Pelle,
            closes #1509)  Make option test check all number options with
            empty value.

diff --git a/src/gen_opt_test.vim b/src/gen_opt_test.vim
index 39705063bad5aae32072ae764d4d71de018c6593..745e5ea4c1896f26215ee0cc9d1dab50dd276d63 100644 (file)
--- a/src/gen_opt_test.vim
+++ b/src/gen_opt_test.vim
@@ -46,6 +46,7 @@ let test_values = {
       \ 'updatecount': [[0, 1, 8, 9999], [-1]],
       \ 'updatetime': [[0, 1, 8, 9999], [-1]],
       \ 'verbose': [[-1, 0, 1, 8, 9999], []],
+      \ 'wildcharm': [[-1, 0, 100], []],
       \ 'winheight': [[1, 10, 999], [-1, 0]],
       \ 'winminheight': [[0, 1], [-1]],
       \ 'winminwidth': [[0, 1, 10], [-1]],
@@ -137,7 +138,7 @@ let test_values = {
       \ 'rubydll': [[], []],
       \ 'tcldll': [[], []],
       \
-      \ 'othernum': [[-1, 0, 100], []],
+      \ 'othernum': [[-1, 0, 100], ['']],
       \ 'otherstring': [['', 'xxx'], []],
       \}
 

diff --git a/src/option.c b/src/option.c
index 5a8af316b3d8c67ee64bd8c980e0ad5c4c883b09..d948ac696d9164d2a52893cf0f3ff90f445c3343 100644 (file)
--- a/src/option.c
+++ b/src/option.c
@@ -4612,7 +4612,7 @@ do_set(
                                    || (long *)varp == &p_wcm)
                                && (*arg == '<'
                                    || *arg == '^'
-                                   || ((!arg[1] || vim_iswhite(arg[1]))
+                                   || (*arg != NUL && (!arg[1] || vim_iswhite(arg[1]))
                                        && !VIM_ISDIGIT(*arg))))
                        {
                            value = string_to_key(arg);
@@ -5843,7 +5843,7 @@ set_string_option(
                                                           opt_flags)) == NULL)
            did_set_option(opt_idx, opt_flags, TRUE);
 
-       /* call autocomamnd after handling side effects */
+       /* call autocommand after handling side effects */
 #if defined(FEAT_AUTOCMD) && defined(FEAT_EVAL)
        if (saved_oldval != NULL)
        {

diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
index 623e46c6f64194f59350ac30d1ee44708b4e35ec..ac43c1a81d0ecc8caee71afa2d7a4b3edb9adc57 100644 (file)
--- a/src/testdir/test_options.vim
+++ b/src/testdir/test_options.vim
@@ -29,6 +29,19 @@ function! Test_isfname()
   set isfname&
 endfunction
 
+function Test_wildchar()
+  " Empty 'wildchar' used to access invalid memory.
+  call assert_fails('set wildchar=', 'E521:')
+  call assert_fails('set wildchar=abc', 'E521:')
+  set wildchar=<Esc>
+  let a=execute('set wildchar?')
+  call assert_equal("\n  wildchar=<Esc>", a)
+  set wildchar=27
+  let a=execute('set wildchar?')
+  call assert_equal("\n  wildchar=<Esc>", a)
+  set wildchar&
+endfunction
+
 function Test_options()
   let caught = 'ok'
   try

diff --git a/src/version.c b/src/version.c
index 5a60374fb37d3cfa408b997085bc6ae492f24d04..1482343e7f59c571b5a9d77cc51725f28b58f4aa 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    370,
 /**/
     369,
 /**/