vi: fix buffer overrun; code shrink

It was possible for get_input_line() to store its NUL terminator
one character beyond the end of its buffer.

Code shrink in colon():

- Certain colon commands can be matched exactly, as any shorter
  string would be matched earlier, e.g. ':wq' versus ':write'.

- Command matching is now case sensitive so there's no need to
  check for 'N' or 'Q' suffixes.

- Rewrite how commands and arguments are split.

function                                             old     new   delta
colon                                               3848    3751     -97
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-97)             Total: -97 bytes

Signed-off-by: Ron Yorston <rmy@pobox.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 22 insertions, 31 deletions

diff --git a/editors/vi.c b/editors/vi.c
index dd22eb45b..715961019 100644
--- a/editors/vi.c
+++ b/editors/vi.c
@@ -1191,7 +1191,7 @@ static char *get_input_line(const char *prompt)
 	write1(prompt);      // write out the :, /, or ? prompt
 
 	i = strlen(buf);
-	while (i < MAX_INPUT_LEN) {
+	while (i < MAX_INPUT_LEN - 1) {
 		c = get_one_char();
 		if (c == '\n' || c == '\r' || c == 27)
 			break;		// this is end of input
@@ -2572,7 +2572,7 @@ static void colon(char *buf)
 	if (cnt == 0)
 		return;
 	if (strncmp(p, "quit", cnt) == 0
-	 || strncmp(p, "q!", cnt) == 0
+	 || strcmp(p, "q!") == 0
 	) {
 		if (modified_count && p[1] != '!') {
 			status_line_bold("No write since last change (:%s! overrides)", p);
@@ -2582,8 +2582,8 @@ static void colon(char *buf)
 		return;
 	}
 	if (strncmp(p, "write", cnt) == 0
-	 || strncmp(p, "wq", cnt) == 0
-	 || strncmp(p, "wn", cnt) == 0
+	 || strcmp(p, "wq") == 0
+	 || strcmp(p, "wn") == 0
 	 || (p[0] == 'x' && !p[1])
 	) {
 		if (modified_count != 0 || p[0] != 'x') {
@@ -2601,7 +2601,6 @@ static void colon(char *buf)
 			);
 			if (p[0] == 'x'
 			 || p[1] == 'q' || p[1] == 'n'
-			 || p[1] == 'Q' || p[1] == 'N'
 			) {
 				editing = 0;
 			}
@@ -2621,10 +2620,9 @@ static void colon(char *buf)
 #else
 
 	char c, *buf1, *q, *r;
-	char *fn, cmd[MAX_INPUT_LEN], args[MAX_INPUT_LEN];
+	char *fn, cmd[MAX_INPUT_LEN], *cmdend, *args;
 	int i, l, li, b, e;
 	int useforce;
-	char *orig_buf;
 
 	// :3154	// if (-e line 3154) goto it  else stay put
 	// :4,33w! foo	// write a portion of buffer to file "foo"
@@ -2652,35 +2650,29 @@ static void colon(char *buf)
 	fn = current_filename;
 
 	// look for optional address(es)  :.  :1  :1,9   :'q,'a   :%
-	orig_buf = buf;
+	buf1 = buf;
 	buf = get_address(buf, &b, &e);
 	if (buf == NULL) {
-		status_line_bold("Bad address: %s", orig_buf);
+		status_line_bold("Bad address: %s", buf1);
 		goto ret;
 	}
 
-# if ENABLE_FEATURE_VI_SEARCH || ENABLE_FEATURE_ALLOW_EXEC
-	// remember orig command line
-	orig_buf = buf;
-# endif
-
 	// get the COMMAND into cmd[]
+	strcpy(cmd, buf);
 	buf1 = cmd;
-	while (*buf != '\0') {
-		if (isspace(*buf))
-			break;
-		*buf1++ = *buf++;
+	while (!isspace(*buf1) && *buf1 != '\0') {
+		buf1++;
 	}
-	*buf1 = '\0';
+	cmdend = buf1;
 	// get any ARGuments
-	while (isblank(*buf))
-		buf++;
-	strcpy(args, buf);
+	while (isblank(*buf1))
+		buf1++;
+	args = buf1;
+	*cmdend = '\0';
 	useforce = FALSE;
-	buf1 = last_char_is(cmd, '!');
-	if (buf1) {
+	if (cmdend > cmd && cmdend[-1] == '!') {
 		useforce = TRUE;
-		*buf1 = '\0';   // get rid of !
+		cmdend[-1] = '\0';   // get rid of !
 	}
 	// assume the command will want a range, certain commands
 	// (read, substitute) need to adjust these assumptions
@@ -2718,7 +2710,7 @@ static void colon(char *buf)
 		// :!ls   run the <cmd>
 		go_bottom_and_clear_to_eol();
 		cookmode();
-		retcode = system(orig_buf + 1);	// run the cmd
+		retcode = system(buf + 1);	// run the cmd
 		if (retcode)
 			printf("\nshell returned %i\n\n", retcode);
 		rawmode();
@@ -2969,8 +2961,8 @@ static void colon(char *buf)
 		// F points to the "find" pattern
 		// R points to the "replace" pattern
 		// replace the cmd line delimiters "/" with NULs
-		c = orig_buf[1];	// what is the delimiter
-		F = orig_buf + 2;	// start of "find"
+		c = buf[1];	// what is the delimiter
+		F = buf + 2;	// start of "find"
 		R = strchr(F, c);	// middle delimiter
 		if (!R)
 			goto colon_s_fail;
@@ -3039,8 +3031,8 @@ static void colon(char *buf)
 	} else if (strncmp(cmd, "version", i) == 0) {  // show software version
 		status_line(BB_VER);
 	} else if (strncmp(cmd, "write", i) == 0  // write text to file
-	        || strncmp(cmd, "wq", i) == 0
-	        || strncmp(cmd, "wn", i) == 0
+	        || strcmp(cmd, "wq") == 0
+	        || strcmp(cmd, "wn") == 0
 	        || (cmd[0] == 'x' && !cmd[1])
 	) {
 		int size;
@@ -3096,7 +3088,6 @@ static void colon(char *buf)
 				}
 				if (cmd[0] == 'x'
 				 || cmd[1] == 'q' || cmd[1] == 'n'
-				 || cmd[1] == 'Q' || cmd[1] == 'N'
 				) {
 					editing = 0;
 				}