To: vim_dev@googlegroups.com
Subject: Patch 7.3.148
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 7.3.148
Problem:    A syntax file with a huge number of items or clusters causes weird
	    behavior, a hang or a crash. (Yukihiro Nakadaira)
Solution:   Check running out of IDs. (partly by Ben Schmidt)
Files:	    src/syntax.c


*** ../vim-7.3.147/src/syntax.c	2011-01-22 00:58:15.000000000 +0100
--- src/syntax.c	2011-04-01 14:25:39.000000000 +0200
***************
*** 219,234 ****
  
  /*
   * Syntax group IDs have different types:
!  *     0 -  9999  normal syntax groups
!  * 10000 - 14999  ALLBUT indicator (current_syn_inc_tag added)
!  * 15000 - 19999  TOP indicator (current_syn_inc_tag added)
!  * 20000 - 24999  CONTAINED indicator (current_syn_inc_tag added)
!  * >= 25000	  cluster IDs (subtract SYNID_CLUSTER for the cluster ID)
!  */
! #define SYNID_ALLBUT	10000	    /* syntax group ID for contains=ALLBUT */
! #define SYNID_TOP	15000	    /* syntax group ID for contains=TOP */
! #define SYNID_CONTAINED	20000	    /* syntax group ID for contains=CONTAINED */
! #define SYNID_CLUSTER	25000	    /* first syntax group ID for clusters */
  
  /*
   * Annoying Hack(TM):  ":syn include" needs this pointer to pass to
--- 219,238 ----
  
  /*
   * Syntax group IDs have different types:
!  *     0 - 19999  normal syntax groups
!  * 20000 - 20999  ALLBUT indicator (current_syn_inc_tag added)
!  * 21000 - 21999  TOP indicator (current_syn_inc_tag added)
!  * 22000 - 22999  CONTAINED indicator (current_syn_inc_tag added)
!  * 23000 - 32767  cluster IDs (subtract SYNID_CLUSTER for the cluster ID)
!  */
! #define SYNID_ALLBUT	20000	    /* syntax group ID for contains=ALLBUT */
! #define SYNID_TOP	21000	    /* syntax group ID for contains=TOP */
! #define SYNID_CONTAINED	22000	    /* syntax group ID for contains=CONTAINED */
! #define SYNID_CLUSTER	23000	    /* first syntax group ID for clusters */
! 
! #define MAX_SYNID       SYNID_ALLBUT
! #define MAX_SYN_INC_TAG	999	    /* maximum before the above overflow */
! #define MAX_CLUSTER_ID  (32767 - SYNID_CLUSTER)
  
  /*
   * Annoying Hack(TM):  ":syn include" needs this pointer to pass to
***************
*** 3442,3447 ****
--- 3446,3454 ----
      /* free the stored states */
      syn_stack_free_all(block);
      invalidate_current_state();
+ 
+     /* Reset the counter for ":syn include" */
+     running_syn_inc_tag = 0;
  }
  
  /*
***************
*** 4661,4666 ****
--- 4668,4675 ----
  	    return;
  	}
  	sgl_id = syn_check_cluster(arg, (int)(group_name_end - arg));
+ 	if (sgl_id == 0)
+ 	    return;
  	/* separate_nextcmd() and expand_filename() depend on this */
  	eap->arg = rest;
      }
***************
*** 4689,4694 ****
--- 4698,4708 ----
       * Save and restore the existing top-level grouplist id and ":syn
       * include" tag around the actual inclusion.
       */
+     if (running_syn_inc_tag >= MAX_SYN_INC_TAG)
+     {
+ 	EMSG((char_u *)_("E847: Too many syntax includes"));
+ 	return;
+     }
      prev_syn_inc_tag = current_syn_inc_tag;
      current_syn_inc_tag = ++running_syn_inc_tag;
      prev_toplvl_grp = curwin->w_s->b_syn_topgrp;
***************
*** 4712,4718 ****
      char_u	*group_name_end;
      int		syn_id;
      char_u	*rest;
!     char_u	*keyword_copy;
      char_u	*p;
      char_u	*kw;
      syn_opt_arg_T syn_opt_arg;
--- 4726,4732 ----
      char_u	*group_name_end;
      int		syn_id;
      char_u	*rest;
!     char_u	*keyword_copy = NULL;
      char_u	*p;
      char_u	*kw;
      syn_opt_arg_T syn_opt_arg;
***************
*** 4724,4732 ****
      if (rest != NULL)
      {
  	syn_id = syn_check_group(arg, (int)(group_name_end - arg));
! 
! 	/* allocate a buffer, for removing the backslashes in the keyword */
! 	keyword_copy = alloc((unsigned)STRLEN(rest) + 1);
  	if (keyword_copy != NULL)
  	{
  	    syn_opt_arg.flags = 0;
--- 4738,4746 ----
      if (rest != NULL)
      {
  	syn_id = syn_check_group(arg, (int)(group_name_end - arg));
! 	if (syn_id != 0)
! 	    /* allocate a buffer, for removing backslashes in the keyword */
! 	    keyword_copy = alloc((unsigned)STRLEN(rest) + 1);
  	if (keyword_copy != NULL)
  	{
  	    syn_opt_arg.flags = 0;
***************
*** 5133,5139 ****
  			    (item == ITEM_SKIP) ? SPTYPE_SKIP : SPTYPE_END;
  		    SYN_ITEMS(curwin->w_s)[idx].sp_flags |= syn_opt_arg.flags;
  		    SYN_ITEMS(curwin->w_s)[idx].sp_syn.id = syn_id;
! 		    SYN_ITEMS(curwin->w_s)[idx].sp_syn.inc_tag = current_syn_inc_tag;
  		    SYN_ITEMS(curwin->w_s)[idx].sp_syn_match_id =
  							ppp->pp_matchgroup_id;
  #ifdef FEAT_CONCEAL
--- 5147,5154 ----
  			    (item == ITEM_SKIP) ? SPTYPE_SKIP : SPTYPE_END;
  		    SYN_ITEMS(curwin->w_s)[idx].sp_flags |= syn_opt_arg.flags;
  		    SYN_ITEMS(curwin->w_s)[idx].sp_syn.id = syn_id;
! 		    SYN_ITEMS(curwin->w_s)[idx].sp_syn.inc_tag =
! 							  current_syn_inc_tag;
  		    SYN_ITEMS(curwin->w_s)[idx].sp_syn_match_id =
  							ppp->pp_matchgroup_id;
  #ifdef FEAT_CONCEAL
***************
*** 5426,5431 ****
--- 5441,5454 ----
  	curwin->w_s->b_syn_clusters.ga_growsize = 10;
      }
  
+     len = curwin->w_s->b_syn_clusters.ga_len;
+     if (len >= MAX_CLUSTER_ID)
+     {
+ 	EMSG((char_u *)_("E848: Too many syntax clusters"));
+ 	vim_free(name);
+ 	return 0;
+     }
+ 
      /*
       * Make room for at least one other cluster entry.
       */
***************
*** 5434,5440 ****
  	vim_free(name);
  	return 0;
      }
-     len = curwin->w_s->b_syn_clusters.ga_len;
  
      vim_memset(&(SYN_CLSTR(curwin->w_s)[len]), 0, sizeof(syn_cluster_T));
      SYN_CLSTR(curwin->w_s)[len].scl_name = name;
--- 5457,5462 ----
***************
*** 5476,5483 ****
  
      if (rest != NULL)
      {
! 	scl_id = syn_check_cluster(arg, (int)(group_name_end - arg))
! 							      - SYNID_CLUSTER;
  
  	for (;;)
  	{
--- 5498,5507 ----
  
      if (rest != NULL)
      {
! 	scl_id = syn_check_cluster(arg, (int)(group_name_end - arg));
! 	if (scl_id == 0)
! 	    return;
! 	scl_id -= SYNID_CLUSTER;
  
  	for (;;)
  	{
***************
*** 5516,5522 ****
  	if (got_clstr)
  	{
  	    redraw_curbuf_later(SOME_VALID);
! 	    syn_stack_free_all(curwin->w_s);	/* Need to recompute all syntax. */
  	}
      }
  
--- 5540,5546 ----
  	if (got_clstr)
  	{
  	    redraw_curbuf_later(SOME_VALID);
! 	    syn_stack_free_all(curwin->w_s);	/* Need to recompute all. */
  	}
      }
  
***************
*** 8972,8977 ****
--- 8996,9008 ----
  	highlight_ga.ga_growsize = 10;
      }
  
+     if (highlight_ga.ga_len >= MAX_SYNID)
+     {
+ 	EMSG(_("E849: Too many syntax groups"));
+ 	vim_free(name);
+ 	return 0;
+     }
+ 
      /*
       * Make room for at least one other syntax_highlight entry.
       */
*** ../vim-7.3.147/src/version.c	2011-04-01 13:05:37.000000000 +0200
--- src/version.c	2011-04-01 14:26:44.000000000 +0200
***************
*** 716,717 ****
--- 716,719 ----
  {   /* Add new patch number below this line */
+ /**/
+     148,
  /**/

-- 
BLACK KNIGHT: None shall pass.
ARTHUR:       I have no quarrel with you, brave Sir knight, but I must cross
              this bridge.
BLACK KNIGHT: Then you shall die.
                 "Monty Python and the Holy Grail" PYTHON (MONTY) PICTURES LTD

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///
