adam/vim
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

patch 9.1.1469: potential buffer-underflow with invalid hl_id

Browse Source 
Problem:  potential buffer-underflow with invalid hl_id (mugitya03)
Solution: assert that the return-code of syn_get_final_id() if > 0

As a safety check, syn_get_final_id() may return zero when either the
provided hl_id is zero or larger than expected.

However, many callers of syn_get_final_id() do not check that the return
value is larger than zero but re-use the returned highlight id directly
like this:

  hl_id = syn_get_final_id(hl_id);
  sgp = &HL_TABLE()[hl_id - 1];	    // index is ID minus one

in which case, this would cause a buffer underrun and an access violation.

Let's use assert(hl_id > 0); to make sure that hl_id is larger than
zero.

Note to myself: I'll need to compile releases builds using -DNDEBUG once
a new release will be made

fixes: #17475
closes: #17512

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt
2025-06-18 18:28:19 +02:00
parent 03e5ee25fd
commit 9d065a4862
3 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/highlight.c
View File

@ -3689,6 +3689,8 @@ syn_id2attr(int hl_id)
hl_group_T *sgp;
hl_id = syn_get_final_id(hl_id);
// shouldn't happen
assert(hl_id > 0);
sgp = &HL_TABLE()[hl_id - 1]; // index is ID minus one
#ifdef FEAT_GUI
@ -3716,6 +3718,8 @@ syn_id2colors(int hl_id, guicolor_T *fgp, guicolor_T *bgp)
hl_group_T *sgp;
hl_id = syn_get_final_id(hl_id);
// shouldn't happen
assert(hl_id > 0);
sgp = &HL_TABLE()[hl_id - 1]; // index is ID minus one
*fgp = sgp->sg_gui_fg;
@ -3734,6 +3738,8 @@ syn_id2cterm_bg(int hl_id, int *fgp, int *bgp)
hl_group_T *sgp;
hl_id = syn_get_final_id(hl_id);
// shouldn't happen
assert(hl_id > 0);
sgp = &HL_TABLE()[hl_id - 1]; // index is ID minus one
*fgp = sgp->sg_cterm_fg - 1;
*bgp = sgp->sg_cterm_bg - 1;