From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 22 Jan 2017 14:05:12 +0000 (+0100)
Subject: patch 8.0.0212: buffer for key name may be too small
X-Git-Tag: v8.0.0212
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=423977d3cebac2be1158b1d11da60fe96db4b750;p=vim

patch 8.0.0212: buffer for key name may be too small

Problem:    The buffer used to store a key name theoreticaly could be too
            small. (Coverity)
Solution:   Count all possible modifier characters.  Add a check for the
            length just in case.
---

diff --git a/src/keymap.h b/src/keymap.h
index 9efecfbef..776a53276 100644
--- a/src/keymap.h
+++ b/src/keymap.h
@@ -482,9 +482,10 @@ enum key_extra
 
 /*
  * The length of the longest special key name, including modifiers.
- * Current longest is <M-C-S-T-4-MiddleRelease> (length includes '<' and '>').
+ * Current longest is <M-C-S-T-D-A-4-ScrollWheelRight> (length includes '<' and
+ * '>').
  */
-#define MAX_KEY_NAME_LEN    25
+#define MAX_KEY_NAME_LEN    32
 
 /* Maximum length of a special key event as tokens.  This includes modifiers.
  * The longest event is something like <M-C-S-T-4-LeftDrag> which would be the
diff --git a/src/misc2.c b/src/misc2.c
index bf98a646c..26d5970f9 100644
--- a/src/misc2.c
+++ b/src/misc2.c
@@ -2162,6 +2162,7 @@ static struct modmasktable
     /* 'A' must be the last one */
     {MOD_MASK_ALT,		MOD_MASK_ALT,		(char_u)'A'},
     {0, 0, NUL}
+    /* NOTE: when adding an entry, update MAX_KEY_NAME_LEN! */
 };
 
 /*
@@ -2431,6 +2432,7 @@ static struct key_name_entry
     {K_PLUG,		(char_u *)"Plug"},
     {K_CURSORHOLD,	(char_u *)"CursorHold"},
     {0,			NULL}
+    /* NOTE: When adding a long name update MAX_KEY_NAME_LEN. */
 };
 
 #define KEY_NAMES_TABLE_LEN (sizeof(key_names_table) / sizeof(struct key_name_entry))
@@ -2659,8 +2661,13 @@ get_special_key_name(int c, int modifiers)
     }
     else		/* use name of special key */
     {
-	STRCPY(string + idx, key_names_table[table_idx].name);
-	idx = (int)STRLEN(string);
+	size_t len = STRLEN(key_names_table[table_idx].name);
+
+	if (len + idx + 2 <= MAX_KEY_NAME_LEN)
+	{
+	    STRCPY(string + idx, key_names_table[table_idx].name);
+	    idx += (int)len;
+	}
     }
     string[idx++] = '>';
     string[idx] = NUL;
diff --git a/src/version.c b/src/version.c
index 8e33c9681..741b8da1e 100644
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    212,
 /**/
     211,
 /**/