patch 8.1.1812: reading a truncted undo file hangs Vim

Problem:    Reading a truncted undo file hangs Vim.
Solution:   Check for reading EOF. (closes #4769)

diff --git a/src/testdir/test_undo.vim b/src/testdir/test_undo.vim
index 1440660adf9fe54fd79f768d55c57b768e60f415..5154b20b3ba079b4426d90c89e2a6d863d5817a8 100644 (file)
--- a/src/testdir/test_undo.vim
+++ b/src/testdir/test_undo.vim
@@ -335,6 +335,24 @@ func Test_undofile_earlier()
   call delete('Xundofile')
 endfunc
 
+" Check that reading a truncted undo file doesn't hang.
+func Test_undofile_truncated()
+  new
+  call setline(1, 'hello')
+  set ul=100
+  wundo Xundofile
+  let contents = readfile('Xundofile', 'B')
+
+  " try several sizes
+  for size in range(20, 500, 33)
+    call writefile(contents[0:size], 'Xundofile')
+    call assert_fails('rundo Xundofile', 'E825:')
+  endfor
+
+  bwipe!
+"  call delete('Xundofile')
+endfunc
+
 " Test for undo working properly when executing commands from a register.
 " Also test this in an empty buffer.
 func Test_cmd_in_reg_undo()

diff --git a/src/undo.c b/src/undo.c
index 4a4a33cc1b3675fc63b205072bfe4ebf431d97d6..a23c2638f45663d69919de282cbcb816070945cf 100644 (file)
--- a/src/undo.c
+++ b/src/undo.c
@@ -1317,6 +1317,12 @@ unserialize_uhp(bufinfo_T *bi, char_u *file_name)
        int len = undo_read_byte(bi);
        int what;
 
+       if (len == EOF)
+       {
+           corruption_error("truncated", file_name);
+           u_free_uhp(uhp);
+           return NULL;
+       }
        if (len == 0)
            break;
        what = undo_read_byte(bi);

diff --git a/src/version.c b/src/version.c
index 32759b170951b8897de81b4557320dbca1b036af..71a14ad66b846d5d534a8d5521583ea6edff2f33 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -773,6 +773,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1812,
 /**/
     1811,
 /**/