To: vim_dev@googlegroups.com
Subject: Patch 9.0.0289
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 9.0.0289
Problem:    Invalid memory write.
Solution:   Do not put NUL in a static string.
Files:      src/message.c


*** ../vim-9.0.0288/src/message.c	2022-08-27 21:29:28.257402847 +0100
--- src/message.c	2022-08-27 21:48:18.692208339 +0100
***************
*** 2237,2256 ****
      static void
  put_msg_win(win_T *wp, int where, char_u *t_s, char_u *end, linenr_T lnum)
  {
!     int	    c = *end;
  
-     *end = NUL;
      if (where == PUT_BELOW)
! 	ml_append_buf(wp->w_buffer, lnum, t_s, (colnr_T)0, FALSE);
      else
      {
  	char_u *newp;
  
  	curbuf = wp->w_buffer;
  	if (where == PUT_APPEND)
  	    newp = concat_str(ml_get(lnum), t_s);
  	else
  	    newp = vim_strnsave(t_s, end - t_s);
  	ml_replace(lnum, newp, FALSE);
  	curbuf = curwin->w_buffer;
      }
--- 2237,2277 ----
      static void
  put_msg_win(win_T *wp, int where, char_u *t_s, char_u *end, linenr_T lnum)
  {
!     char_u  *p;
  
      if (where == PUT_BELOW)
!     {
! 	if (*end != NUL)
! 	{
! 	    p = vim_strnsave(t_s, end - t_s);
! 	    if (p == NULL)
! 		return;
! 	}
! 	else
! 	    p = t_s;
! 	ml_append_buf(wp->w_buffer, lnum, p, (colnr_T)0, FALSE);
! 	if (p != t_s)
! 	    vim_free(p);
!     }
      else
      {
  	char_u *newp;
  
  	curbuf = wp->w_buffer;
  	if (where == PUT_APPEND)
+ 	{
  	    newp = concat_str(ml_get(lnum), t_s);
+ 	    if (newp == NULL)
+ 		return;
+ 	    if (*end != NUL)
+ 		newp[STRLEN(ml_get(lnum)) + (end - t_s)] = NUL;
+ 	}
  	else
+ 	{
  	    newp = vim_strnsave(t_s, end - t_s);
+ 	    if (newp == NULL)
+ 		return;
+ 	}
  	ml_replace(lnum, newp, FALSE);
  	curbuf = curwin->w_buffer;
      }
***************
*** 2258,2265 ****
  
      // set msg_col so that a newline is written if needed
      msg_col = STRLEN(t_s);
- 
-     *end = c;
  }
  #endif
  
--- 2279,2284 ----
*** ../vim-9.0.0288/src/version.c	2022-08-27 21:29:28.261402810 +0100
--- src/version.c	2022-08-27 21:49:02.768103475 +0100
***************
*** 709,710 ****
--- 709,712 ----
  {   /* Add new patch number below this line */
+ /**/
+     289,
  /**/

-- 
Living on Earth includes an annual free trip around the Sun.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///                                                                      \\\
\\\        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///