1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
To: vim-dev@vim.org
Subject: Patch 7.2.406
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------
Patch 7.2.406
Problem: Patch 7.2.119 introduces uninit mem read. (Dominique Pelle)
Solution: Only used ScreeenLinesC when ScreeenLinesUC is not zero. (Yukihiro
Nakadaira) Also clear ScreeenLinesC when allocating.
Files: src/screen.c
*** ../vim-7.2.405/src/screen.c 2010-03-23 13:56:53.000000000 +0100
--- src/screen.c 2010-03-23 15:26:44.000000000 +0100
***************
*** 25,34 ****
* one character which occupies two display cells.
* For UTF-8 a multi-byte character is converted to Unicode and stored in
* ScreenLinesUC[]. ScreenLines[] contains the first byte only. For an ASCII
! * character without composing chars ScreenLinesUC[] will be 0. When the
! * character occupies two display cells the next byte in ScreenLines[] is 0.
* ScreenLinesC[][] contain up to 'maxcombine' composing characters
! * (drawn on top of the first character). They are 0 when not used.
* ScreenLines2[] is only used for euc-jp to store the second byte if the
* first byte is 0x8e (single-width character).
*
--- 25,35 ----
* one character which occupies two display cells.
* For UTF-8 a multi-byte character is converted to Unicode and stored in
* ScreenLinesUC[]. ScreenLines[] contains the first byte only. For an ASCII
! * character without composing chars ScreenLinesUC[] will be 0 and
! * ScreenLinesC[][] is not used. When the character occupies two display
! * cells the next byte in ScreenLines[] is 0.
* ScreenLinesC[][] contain up to 'maxcombine' composing characters
! * (drawn on top of the first character). There is 0 after the last one used.
* ScreenLines2[] is only used for euc-jp to store the second byte if the
* first byte is 0x8e (single-width character).
*
***************
*** 4893,4898 ****
--- 4894,4900 ----
/*
* Return if the composing characters at "off_from" and "off_to" differ.
+ * Only to be used when ScreenLinesUC[off_from] != 0.
*/
static int
comp_char_differs(off_from, off_to)
***************
*** 6281,6286 ****
--- 6283,6289 ----
/*
* Return TRUE if composing characters for screen posn "off" differs from
* composing characters in "u8cc".
+ * Only to be used when ScreenLinesUC[off] != 0.
*/
static int
screen_comp_differs(off, u8cc)
***************
*** 6461,6468 ****
&& c == 0x8e
&& ScreenLines2[off] != ptr[1])
|| (enc_utf8
! && (ScreenLinesUC[off] != (u8char_T)(c >= 0x80 ? u8c : 0)
! || screen_comp_differs(off, u8cc)))
#endif
|| ScreenAttrs[off] != attr
|| exmode_active;
--- 6464,6473 ----
&& c == 0x8e
&& ScreenLines2[off] != ptr[1])
|| (enc_utf8
! && (ScreenLinesUC[off] !=
! (u8char_T)(c < 0x80 && u8cc[0] == 0 ? 0 : u8c)
! || (ScreenLinesUC[off] != 0
! && screen_comp_differs(off, u8cc))))
#endif
|| ScreenAttrs[off] != attr
|| exmode_active;
***************
*** 7542,7548 ****
new_ScreenLinesUC = (u8char_T *)lalloc((long_u)(
(Rows + 1) * Columns * sizeof(u8char_T)), FALSE);
for (i = 0; i < p_mco; ++i)
! new_ScreenLinesC[i] = (u8char_T *)lalloc((long_u)(
(Rows + 1) * Columns * sizeof(u8char_T)), FALSE);
}
if (enc_dbcs == DBCS_JPNU)
--- 7547,7553 ----
new_ScreenLinesUC = (u8char_T *)lalloc((long_u)(
(Rows + 1) * Columns * sizeof(u8char_T)), FALSE);
for (i = 0; i < p_mco; ++i)
! new_ScreenLinesC[i] = (u8char_T *)lalloc_clear((long_u)(
(Rows + 1) * Columns * sizeof(u8char_T)), FALSE);
}
if (enc_dbcs == DBCS_JPNU)
*** ../vim-7.2.405/src/version.c 2010-03-23 14:39:07.000000000 +0100
--- src/version.c 2010-03-23 15:34:11.000000000 +0100
***************
*** 683,684 ****
--- 683,686 ----
{ /* Add new patch number below this line */
+ /**/
+ 406,
/**/
--
VOICE OVER: As the horrendous Black Beast lunged forward, escape for Arthur
and his knights seemed hopeless, when, suddenly ... the animator
suffered a fatal heart attack.
ANIMATOR: Aaaaagh!
VOICE OVER: The cartoon peril was no more ... The Quest for Holy Grail could
continue.
"Monty Python and the Holy Grail" PYTHON (MONTY) PICTURES LTD
/// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\
/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ download, build and distribute -- http://www.A-A-P.org ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///
|
