To: vim_dev@googlegroups.com Subject: Patch 7.3.148 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ------------ Patch 7.3.148 Problem: A syntax file with a huge number of items or clusters causes weird behavior, a hang or a crash. (Yukihiro Nakadaira) Solution: Check running out of IDs. (partly by Ben Schmidt) Files: src/syntax.c *** ../vim-7.3.147/src/syntax.c 2011-01-22 00:58:15.000000000 +0100 --- src/syntax.c 2011-04-01 14:25:39.000000000 +0200 *************** *** 219,234 **** /* * Syntax group IDs have different types: ! * 0 - 9999 normal syntax groups ! * 10000 - 14999 ALLBUT indicator (current_syn_inc_tag added) ! * 15000 - 19999 TOP indicator (current_syn_inc_tag added) ! * 20000 - 24999 CONTAINED indicator (current_syn_inc_tag added) ! * >= 25000 cluster IDs (subtract SYNID_CLUSTER for the cluster ID) ! */ ! #define SYNID_ALLBUT 10000 /* syntax group ID for contains=ALLBUT */ ! #define SYNID_TOP 15000 /* syntax group ID for contains=TOP */ ! #define SYNID_CONTAINED 20000 /* syntax group ID for contains=CONTAINED */ ! #define SYNID_CLUSTER 25000 /* first syntax group ID for clusters */ /* * Annoying Hack(TM): ":syn include" needs this pointer to pass to --- 219,238 ---- /* * Syntax group IDs have different types: ! * 0 - 19999 normal syntax groups ! * 20000 - 20999 ALLBUT indicator (current_syn_inc_tag added) ! * 21000 - 21999 TOP indicator (current_syn_inc_tag added) ! * 22000 - 22999 CONTAINED indicator (current_syn_inc_tag added) ! * 23000 - 32767 cluster IDs (subtract SYNID_CLUSTER for the cluster ID) ! */ ! #define SYNID_ALLBUT 20000 /* syntax group ID for contains=ALLBUT */ ! #define SYNID_TOP 21000 /* syntax group ID for contains=TOP */ ! #define SYNID_CONTAINED 22000 /* syntax group ID for contains=CONTAINED */ ! #define SYNID_CLUSTER 23000 /* first syntax group ID for clusters */ ! ! #define MAX_SYNID SYNID_ALLBUT ! #define MAX_SYN_INC_TAG 999 /* maximum before the above overflow */ ! #define MAX_CLUSTER_ID (32767 - SYNID_CLUSTER) /* * Annoying Hack(TM): ":syn include" needs this pointer to pass to *************** *** 3442,3447 **** --- 3446,3454 ---- /* free the stored states */ syn_stack_free_all(block); invalidate_current_state(); + + /* Reset the counter for ":syn include" */ + running_syn_inc_tag = 0; } /* *************** *** 4661,4666 **** --- 4668,4675 ---- return; } sgl_id = syn_check_cluster(arg, (int)(group_name_end - arg)); + if (sgl_id == 0) + return; /* separate_nextcmd() and expand_filename() depend on this */ eap->arg = rest; } *************** *** 4689,4694 **** --- 4698,4708 ---- * Save and restore the existing top-level grouplist id and ":syn * include" tag around the actual inclusion. */ + if (running_syn_inc_tag >= MAX_SYN_INC_TAG) + { + EMSG((char_u *)_("E847: Too many syntax includes")); + return; + } prev_syn_inc_tag = current_syn_inc_tag; current_syn_inc_tag = ++running_syn_inc_tag; prev_toplvl_grp = curwin->w_s->b_syn_topgrp; *************** *** 4712,4718 **** char_u *group_name_end; int syn_id; char_u *rest; ! char_u *keyword_copy; char_u *p; char_u *kw; syn_opt_arg_T syn_opt_arg; --- 4726,4732 ---- char_u *group_name_end; int syn_id; char_u *rest; ! char_u *keyword_copy = NULL; char_u *p; char_u *kw; syn_opt_arg_T syn_opt_arg; *************** *** 4724,4732 **** if (rest != NULL) { syn_id = syn_check_group(arg, (int)(group_name_end - arg)); ! ! /* allocate a buffer, for removing the backslashes in the keyword */ ! keyword_copy = alloc((unsigned)STRLEN(rest) + 1); if (keyword_copy != NULL) { syn_opt_arg.flags = 0; --- 4738,4746 ---- if (rest != NULL) { syn_id = syn_check_group(arg, (int)(group_name_end - arg)); ! if (syn_id != 0) ! /* allocate a buffer, for removing backslashes in the keyword */ ! keyword_copy = alloc((unsigned)STRLEN(rest) + 1); if (keyword_copy != NULL) { syn_opt_arg.flags = 0; *************** *** 5133,5139 **** (item == ITEM_SKIP) ? SPTYPE_SKIP : SPTYPE_END; SYN_ITEMS(curwin->w_s)[idx].sp_flags |= syn_opt_arg.flags; SYN_ITEMS(curwin->w_s)[idx].sp_syn.id = syn_id; ! SYN_ITEMS(curwin->w_s)[idx].sp_syn.inc_tag = current_syn_inc_tag; SYN_ITEMS(curwin->w_s)[idx].sp_syn_match_id = ppp->pp_matchgroup_id; #ifdef FEAT_CONCEAL --- 5147,5154 ---- (item == ITEM_SKIP) ? SPTYPE_SKIP : SPTYPE_END; SYN_ITEMS(curwin->w_s)[idx].sp_flags |= syn_opt_arg.flags; SYN_ITEMS(curwin->w_s)[idx].sp_syn.id = syn_id; ! SYN_ITEMS(curwin->w_s)[idx].sp_syn.inc_tag = ! current_syn_inc_tag; SYN_ITEMS(curwin->w_s)[idx].sp_syn_match_id = ppp->pp_matchgroup_id; #ifdef FEAT_CONCEAL *************** *** 5426,5431 **** --- 5441,5454 ---- curwin->w_s->b_syn_clusters.ga_growsize = 10; } + len = curwin->w_s->b_syn_clusters.ga_len; + if (len >= MAX_CLUSTER_ID) + { + EMSG((char_u *)_("E848: Too many syntax clusters")); + vim_free(name); + return 0; + } + /* * Make room for at least one other cluster entry. */ *************** *** 5434,5440 **** vim_free(name); return 0; } - len = curwin->w_s->b_syn_clusters.ga_len; vim_memset(&(SYN_CLSTR(curwin->w_s)[len]), 0, sizeof(syn_cluster_T)); SYN_CLSTR(curwin->w_s)[len].scl_name = name; --- 5457,5462 ---- *************** *** 5476,5483 **** if (rest != NULL) { ! scl_id = syn_check_cluster(arg, (int)(group_name_end - arg)) ! - SYNID_CLUSTER; for (;;) { --- 5498,5507 ---- if (rest != NULL) { ! scl_id = syn_check_cluster(arg, (int)(group_name_end - arg)); ! if (scl_id == 0) ! return; ! scl_id -= SYNID_CLUSTER; for (;;) { *************** *** 5516,5522 **** if (got_clstr) { redraw_curbuf_later(SOME_VALID); ! syn_stack_free_all(curwin->w_s); /* Need to recompute all syntax. */ } } --- 5540,5546 ---- if (got_clstr) { redraw_curbuf_later(SOME_VALID); ! syn_stack_free_all(curwin->w_s); /* Need to recompute all. */ } } *************** *** 8972,8977 **** --- 8996,9008 ---- highlight_ga.ga_growsize = 10; } + if (highlight_ga.ga_len >= MAX_SYNID) + { + EMSG(_("E849: Too many syntax groups")); + vim_free(name); + return 0; + } + /* * Make room for at least one other syntax_highlight entry. */ *** ../vim-7.3.147/src/version.c 2011-04-01 13:05:37.000000000 +0200 --- src/version.c 2011-04-01 14:26:44.000000000 +0200 *************** *** 716,717 **** --- 716,719 ---- { /* Add new patch number below this line */ + /**/ + 148, /**/ -- BLACK KNIGHT: None shall pass. ARTHUR: I have no quarrel with you, brave Sir knight, but I must cross this bridge. BLACK KNIGHT: Then you shall die. "Monty Python and the Holy Grail" PYTHON (MONTY) PICTURES LTD /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\ \\\ an exciting new programming language -- http://www.Zimbu.org /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///