CVE-2018-11319: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a directory that is a parent of the base directory of the project being checked. NOTE: exploitation is more difficult after 3.8.0 because filename prediction may be needed.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2018-05-20T20:29Z
Repository: https://github.com/vim-syntastic/syntastic
Language: Other
Files changed: autoload/syntastic/c.vim, doc/syntastic-checkers.txt, plugin/syntastic.vim, syntax_checkers/c/avrgcc.vim, syntax_checkers/c/clang_check.vim, syntax_checkers/c/clang_tidy.vim, syntax_checkers/c/cppcheck.vim, syntax_checkers/c/oclint.vim, syntax_checkers/c/pc_lint.vim, syntax_checkers/c/sparse.vim, syntax_checkers/c/splint.vim, syntax_checkers/cpp/verapp.vim, syntax_checkers/cuda/nvcc.vim
Commit date: 2018-04-17 08:56:58 +0300
Commit message: Security: clear defaults for config file names (cf. #2170).

Diff: diff --git a/autoload/syntastic/c.vim b/autoload/syntastic/c.vim
index e49a29a0..c4ce2000 100644
--- a/autoload/syntastic/c.vim
+++ b/autoload/syntastic/c.vim
@@ -226,11 +226,11 @@ function! s:_get_cflags(ft, ck, opts) abort " {{{2
     if b_cflags !=# ''
         let flags .= ' ' . b_cflags
     endif
 
     " add optional config file parameters
-    let config_file = s:_get_checker_var('g', a:ft, a:ck, 'config_file', '.syntastic_' . a:ft . '_config')
+    let config_file = s:_get_checker_var('b', a:ft, a:ck, 'config_file', s:_get_checker_var('g', a:ft, a:ck, 'config_file', ''))
     let flags .= ' ' . syntastic#c#ReadConfig(config_file)
 
     if b_cflags ==# '' && (a:ft ==# 'c' || a:ft ==# 'cpp') && !s:_get_checker_var('g', a:ft, a:ck, 'no_include_search', 0)
         " refresh the include file search if desired
         if s:_get_checker_var('g', a:ft, a:ck, 'auto_refresh_includes', 0)
diff --git a/doc/syntastic-checkers.txt b/doc/syntastic-checkers.txt
index 5f256b3a..23f8131a 100644
--- a/doc/syntastic-checkers.txt
+++ b/doc/syntastic-checkers.txt
@@ -232,11 +232,11 @@ Default: unset
 Compilation flags (such as defines or include directories) to be passed to the
 linter.
 
                                                *'g:syntastic_ada_config_file'*
 Type: string
-Default: ".syntastic_ada_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
                                               *'g:syntastic_ada_include_dirs'*
 Type: array of strings
@@ -451,11 +451,11 @@ Compilation flags (such as defines or include directories) to be passed to the
 assembler. Set it to something like "-mtune=native": >
     let g:syntastic_asm_compiler_options = "-mtune=native"
 <
                                                *'g:syntastic_asm_config_file'*
 Type: string
-Default: ".syntastic_asm_config"
+Default: unset
 File containing additional compilation flags to be passed to the assembler,
 one option per line (see |syntastic-config-files|).
 
                                               *'g:syntastic_asm_include_dirs'*
 Type: array of strings
@@ -557,11 +557,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                             *'g:syntastic_avrgcc_config_file'*
 Type: string
-Default: ".syntastic_avrgcc_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 ------------------------------------------------------------------------------
 2. Checkpatch                                         *syntastic-c-checkpatch*
@@ -598,11 +598,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                        *'g:syntastic_clang_check_config_file'*
 Type: string
-Default: ".syntastic_clang_check_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 Note~
 
@@ -649,11 +649,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                         *'g:syntastic_clang_tidy_config_file'*
 Type: string
-Default: ".syntastic_clang_tidy_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 Note~
 
@@ -691,11 +691,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                           *'g:syntastic_cppcheck_config_file'*
 Type: string
-Default: ".syntastic_cppcheck_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 See also: |syntastic-cpp-cppcheck|.
 
@@ -780,11 +780,11 @@ Default: "-std=gnu99"
 Compilation flags (such as defines or include directories) to be passed to the
 linter.
 
                                                  *'g:syntastic_c_config_file'*
 Type: string
-Default: ".syntastic_c_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
                                                 *'g:syntastic_c_include_dirs'*
 Type: array of strings
@@ -874,11 +874,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                             'g:syntastic_oclint_config_file'
 Type: string
-Default: ".syntastic_oclint_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 Notes~
 
@@ -915,11 +915,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                            *'g:syntastic_pc_lint_config_file'*
 Type: string
-Default: "options.lnt"
+Default: unset
 Name of an indirect (.lnt) file. A file with that name is looked up in the
 current directory and in parent directories; first such file found is used.
 
 See also: |syntastic-cpp-pc_lint|.
 
@@ -940,11 +940,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                             *'g:syntastic_sparse_config_file'*
 Type: string
-Default: ".syntastic_sparse_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 Notes~
 
@@ -973,11 +973,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                             *'g:syntastic_splint_config_file'*
 Type: string
-Default: ".syntastic_splint_config"
+Default: unset
 File containing project-specific options to be passed to "Splint"
 (such as defines or include directories), one option per line (cf.
 |syntastic-config-files|).
 
 ==============================================================================
@@ -1033,11 +1033,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                             'g:syntastic_avrgcc_config_file'
 Type: string
-Default: ".syntastic_avrgcc_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 See also: |syntastic-c-avrgcc|.
 
@@ -1060,11 +1060,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                        'g:syntastic_clang_check_config_file'
 Type: string
-Default: ".syntastic_clang_check_config"
+Default: unset
 file containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 Note~
 
@@ -1111,11 +1111,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                         'g:syntastic_clang_tidy_config_file'
 Type: string
-Default: ".syntastic_clang_tidy_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 Note~
 
@@ -1153,11 +1153,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                           'g:syntastic_cppcheck_config_file'
 Type: string
-Default: ".syntastic_cppcheck_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 See also: |syntastic-c-cppcheck|.
 
@@ -1278,11 +1278,11 @@ Default: unset
 Compilation flags (such as defines or include directories) to be passed to the
 linter.
 
                                                *'g:syntastic_cpp_config_file'*
 Type: string
-Default: ".syntastic_cpp_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
                                               *'g:syntastic_cpp_include_dirs'*
 Type: array of strings
@@ -1361,11 +1361,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                             'g:syntastic_oclint_config_file'
 Type: string
-Default: ".syntastic_oclint_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 Notes~
 
@@ -1403,11 +1403,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                            'g:syntastic_pc_lint_config_file'
 Type: string
-Default: "options.lnt"
+Default: unset
 Name of an indirect (.lnt) file. A file with that name is looked up in the
 current directory and in parent directories; first such file found is used.
 
 See also: |syntastic-c-pc_lint|.
 
@@ -1429,11 +1429,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                             *'g:syntastic_verapp_config_file'*
 Type: string
-Default: ".syntastic_verapp_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
 ==============================================================================
 SYNTAX CHECKERS FOR CABAL                           *syntastic-checkers-cabal*
@@ -1560,11 +1560,11 @@ Type: string
 Default: unset
 Compilation flags (such as "-std=cobol2002") to be passed to the linter.
 
                                              *'g:syntastic_cobol_config_file'*
 Type: string
-Default: ".syntastic_cobol_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
                                             *'g:syntastic_cobol_include_dirs'*
 Type: array of strings
@@ -1903,11 +1903,11 @@ Turn this on to check header files.  The checker then creates an empty file
 Example: >
     let g:syntastic_cuda_check_header = 1
 <
                                               *'g:syntastic_cuda_config_file'*
 Type: string
-Default: ".syntastic_cuda_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
 ==============================================================================
 SYNTAX CHECKERS FOR D                                   *syntastic-checkers-d*
@@ -1948,11 +1948,11 @@ Default: unset
 Compilation flags (such as defines or include directories) to be passed to the
 linter.
 
                                                  *'g:syntastic_d_config_file'*
 Type: string
-Default: ".syntastic_d_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
                                                 *'g:syntastic_d_include_dirs'*
 Type: array of strings
@@ -2340,11 +2340,11 @@ Type: string
 Default: unset
 Compilation flags (such as "-std=f95") to be passed to the linter.
 
                                            *'g:syntastic_fortran_config_file'*
 Type: string
-Default: ".syntastic_fortran_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
                                           *'g:syntastic_fortran_include_dirs'*
 Type: array of strings
@@ -4347,11 +4347,11 @@ Default: unset
 Compilation flags (such as defines or include directories) to be passed to the
 linter.
 
                                               *'g:syntastic_objc_config_file'*
 Type: string
-Default: ".syntastic_objc_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
                                              *'g:syntastic_objc_include_dirs'*
 Type: array of strings
@@ -4411,11 +4411,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                             'g:syntastic_oclint_config_file'
 Type: string
-Default: ".syntastic_oclint_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 See also: |syntastic-objcpp-oclint|.
 
@@ -4458,11 +4458,11 @@ Default: unset
 Compilation flags (such as defines or include directories) to be passed to the
 linter.
 
                                             *'g:syntastic_objcpp_config_file'*
 Type: string
-Default: ".syntastic_objcpp_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
                                            *'g:syntastic_objcpp_include_dirs'*
 Type: array of strings
@@ -4522,11 +4522,11 @@ accepts the standard options described at |syntastic-config-makeprg|.
 
 Additionally:
 
                                             'g:syntastic_oclint_config_file'
 Type: string
-Default: ".syntastic_oclint_config"
+Default: unset
 File containing compilation flags (such as defines or include directories),
 one option per line (cf. |syntastic-config-files|).
 
 See also: |syntastic-objc-oclint|.
 
@@ -7028,11 +7028,11 @@ Default: unset
 Compilation flags (such as defines or include directories) to be passed to the
 linter.
 
                                            *'g:syntastic_verilog_config_file'*
 Type: string
-Default: ".syntastic_verilog_config"
+Default: unset
 File containing additional compilation flags to be passed to the linter, one
 option per line (cf. |syntastic-config-files|).
 
                                           *'g:syntastic_verilog_include_dirs'*
 Type: array of strings
diff --git a/plugin/syntastic.vim b/plugin/syntastic.vim
index cedfcfcf..c8a1d181 100644
--- a/plugin/syntastic.vim
+++ b/plugin/syntastic.vim
@@ -17,11 +17,11 @@ let g:loaded_syntastic_plugin = 1
 if has('reltime')
     let g:_SYNTASTIC_START = reltime()
     lockvar! g:_SYNTASTIC_START
 endif
 
-let g:_SYNTASTIC_VERSION = '3.8.0-110'
+let g:_SYNTASTIC_VERSION = '3.8.0-113'
 lockvar g:_SYNTASTIC_VERSION
 
 " Sanity checks {{{1
 
 if v:version < 700 || (v:version == 700 && !has('patch175'))
diff --git a/syntax_checkers/c/avrgcc.vim b/syntax_checkers/c/avrgcc.vim
index a4124975..510127e8 100644
--- a/syntax_checkers/c/avrgcc.vim
+++ b/syntax_checkers/c/avrgcc.vim
@@ -13,22 +13,20 @@
 if exists('g:loaded_syntastic_c_avrgcc_checker')
     finish
 endif
 let g:loaded_syntastic_c_avrgcc_checker = 1
 
-if !exists('g:syntastic_avrgcc_config_file')
-    let g:syntastic_avrgcc_config_file = '.syntastic_avrgcc_config'
-endif
-
 let s:save_cpo = &cpo
 set cpo&vim
 
 let s:opt_x = { 'c': 'c', 'cpp': 'c++' }
 
 function! SyntaxCheckers_c_avrgcc_GetLocList() dict
+    let buf = bufnr('')
+
     let makeprg = self.makeprgBuild({
-        \ 'args_before': syntastic#c#ReadConfig(g:syntastic_avrgcc_config_file),
+        \ 'args_before': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'avrgcc_config_file')),
         \ 'args_after': '-x ' . get(s:opt_x, self.getFiletype(), '')  . ' -fsyntax-only' })
 
     let errorformat =
         \ '%-G%f:%s:,' .
         \ '%-G%f:%l: %#error: %#(Each undeclared identifier is reported only%.%#,' .
diff --git a/syntax_checkers/c/clang_check.vim b/syntax_checkers/c/clang_check.vim
index 7a1fb8b7..84a20d81 100644
--- a/syntax_checkers/c/clang_check.vim
+++ b/syntax_checkers/c/clang_check.vim
@@ -12,26 +12,24 @@
 if exists('g:loaded_syntastic_c_clang_check_checker')
     finish
 endif
 let g:loaded_syntastic_c_clang_check_checker = 1
 
-if !exists('g:syntastic_clang_check_config_file')
-    let g:syntastic_clang_check_config_file = '.syntastic_clang_check_config'
-endif
-
 if !exists('g:syntastic_c_clang_check_sort')
     let g:syntastic_c_clang_check_sort = 1
 endif
 
 let s:save_cpo = &cpo
 set cpo&vim
 
 function! SyntaxCheckers_c_clang_check_GetLocList() dict
+    let buf = bufnr('')
+
     let makeprg = self.makeprgBuild({
         \ 'post_args':
         \   '-- ' .
-        \   syntastic#c#ReadConfig(g:syntastic_clang_check_config_file) . ' ' .
+        \   syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'clang_check_config_file')) . ' ' .
         \   '-fshow-column ' .
         \   '-fshow-source-location ' .
         \   '-fno-caret-diagnostics ' .
         \   '-fno-color-diagnostics ' .
         \   '-fdiagnostics-format=clang' })
diff --git a/syntax_checkers/c/clang_tidy.vim b/syntax_checkers/c/clang_tidy.vim
index 9df88a4c..d392ec3e 100644
--- a/syntax_checkers/c/clang_tidy.vim
+++ b/syntax_checkers/c/clang_tidy.vim
@@ -12,26 +12,24 @@
 if exists('g:loaded_syntastic_c_clang_tidy_checker')
     finish
 endif
 let g:loaded_syntastic_c_clang_tidy_checker = 1
 
-if !exists('g:syntastic_clang_tidy_config_file')
-    let g:syntastic_clang_tidy_config_file = '.syntastic_clang_tidy_config'
-endif
-
 if !exists('g:syntastic_c_clang_tidy_sort')
     let g:syntastic_c_clang_tidy_sort = 1
 endif
 
 let s:save_cpo = &cpo
 set cpo&vim
 
 function! SyntaxCheckers_c_clang_tidy_GetLocList() dict
+    let buf = bufnr('')
+
     let makeprg = self.makeprgBuild({
         \ 'post_args':
         \   '-- ' .
-        \   syntastic#c#ReadConfig(g:syntastic_clang_tidy_config_file) . ' ' .
+        \   syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'clang_tidy_config_file')) . ' ' .
         \   '-fshow-column ' .
         \   '-fshow-source-location ' .
         \   '-fno-caret-diagnostics ' .
         \   '-fno-color-diagnostics ' .
         \   '-fdiagnostics-format=clang' })
diff --git a/syntax_checkers/c/cppcheck.vim b/syntax_checkers/c/cppcheck.vim
index e92dc7a9..8fe193d1 100644
--- a/syntax_checkers/c/cppcheck.vim
+++ b/syntax_checkers/c/cppcheck.vim
@@ -12,20 +12,18 @@
 if exists('g:loaded_syntastic_c_cppcheck_checker')
     finish
 endif
 let g:loaded_syntastic_c_cppcheck_checker = 1
 
-if !exists('g:syntastic_cppcheck_config_file')
-    let g:syntastic_cppcheck_config_file = '.syntastic_cppcheck_config'
-endif
-
 let s:save_cpo = &cpo
 set cpo&vim
 
 function! SyntaxCheckers_c_cppcheck_GetLocList() dict
+    let buf = bufnr('')
+
     let makeprg = self.makeprgBuild({
-        \ 'args': syntastic#c#ReadConfig(g:syntastic_cppcheck_config_file),
+        \ 'args': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'cppcheck_config_file')),
         \ 'args_after': '-q --enable=style' })
 
     let errorformat =
         \ '[%f:%l]: (%trror) %m,' .
         \ '[%f:%l]: (%tarning) %m,' .
diff --git a/syntax_checkers/c/oclint.vim b/syntax_checkers/c/oclint.vim
index 467b0973..be005fdd 100644
--- a/syntax_checkers/c/oclint.vim
+++ b/syntax_checkers/c/oclint.vim
@@ -12,24 +12,22 @@
 if exists('g:loaded_syntastic_c_oclint_checker')
     finish
 endif
 let g:loaded_syntastic_c_oclint_checker = 1
 
-if !exists('g:syntastic_oclint_config_file')
-    let g:syntastic_oclint_config_file = '.syntastic_oclint_config'
-endif
-
 if !exists('g:syntastic_c_oclint_sort')
     let g:syntastic_c_oclint_sort = 1
 endif
 
 let s:save_cpo = &cpo
 set cpo&vim
 
 function! SyntaxCheckers_c_oclint_GetLocList() dict
+    let buf = bufnr('')
+
     let makeprg = self.makeprgBuild({
-        \ 'post_args': '-- -c ' . syntastic#c#ReadConfig(g:syntastic_oclint_config_file) })
+        \ 'post_args': '-- -c ' . syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'oclint_config_file') })
 
     let errorformat =
         \ '%E%f:%l:%c: fatal error: %m,' .
         \ '%E%f:%l:%c: error: %m,' .
         \ '%W%f:%l:%c: warning: %m,' .
diff --git a/syntax_checkers/c/pc_lint.vim b/syntax_checkers/c/pc_lint.vim
index a0065ed5..8357a84e 100644
--- a/syntax_checkers/c/pc_lint.vim
+++ b/syntax_checkers/c/pc_lint.vim
@@ -16,17 +16,13 @@ endif
 let g:loaded_syntastic_c_pc_lint_checker = 1
 
 let s:save_cpo = &cpo
 set cpo&vim
 
-if !exists('g:syntastic_pc_lint_config_file')
-    let g:syntastic_pc_lint_config_file = 'options.lnt'
-endif
-
 function! SyntaxCheckers_c_pc_lint_GetLocList() dict
     let buf = bufnr('')
-    let config = syntastic#util#findFileInParent(g:syntastic_pc_lint_config_file, fnamemodify(bufname(buf), ':p:h'))
+    let config = syntastic#util#findFileInParent(syntastic#util#bufVar(buf, 'pc_lint_config_file'), fnamemodify(bufname(buf), ':p:h'))
     call self.log('config =', config)
 
     " -hFs1         - show filename, add space after messages, try to make message 1 line
     " -width(0,0)   - make sure there are no line breaks
     " -t            - set tab size
diff --git a/syntax_checkers/c/sparse.vim b/syntax_checkers/c/sparse.vim
index dc82458f..e9b74859 100644
--- a/syntax_checkers/c/sparse.vim
+++ b/syntax_checkers/c/sparse.vim
@@ -12,20 +12,18 @@
 if exists('g:loaded_syntastic_c_sparse_checker')
     finish
 endif
 let g:loaded_syntastic_c_sparse_checker = 1
 
-if !exists('g:syntastic_sparse_config_file')
-    let g:syntastic_sparse_config_file = '.syntastic_sparse_config'
-endif
-
 let s:save_cpo = &cpo
 set cpo&vim
 
 function! SyntaxCheckers_c_sparse_GetLocList() dict
+    let buf = bufnr('')
+
     let makeprg = self.makeprgBuild({
-        \ 'args': syntastic#c#ReadConfig(g:syntastic_sparse_config_file),
+        \ 'args': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'sparse_config_file')),
         \ 'args_after': '-ftabstop=' . &ts })
 
     let errorformat =
         \ '%f:%l:%v: %trror: %m,' .
         \ '%f:%l:%v: %tarning: %m,'
diff --git a/syntax_checkers/c/splint.vim b/syntax_checkers/c/splint.vim
index 81a9401e..aaedd4ea 100644
--- a/syntax_checkers/c/splint.vim
+++ b/syntax_checkers/c/splint.vim
@@ -12,20 +12,18 @@
 if exists('g:loaded_syntastic_c_splint_checker')
     finish
 endif
 let g:loaded_syntastic_c_splint_checker = 1
 
-if !exists('g:syntastic_splint_config_file')
-    let g:syntastic_splint_config_file = '.syntastic_splint_config'
-endif
-
 let s:save_cpo = &cpo
 set cpo&vim
 
 function! SyntaxCheckers_c_splint_GetLocList() dict
+    let buf = bufnr('')
+
     let makeprg = self.makeprgBuild({
-        \ 'args': syntastic#c#ReadConfig(g:syntastic_splint_config_file),
+        \ 'args': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'splint_config_file')),
         \ 'args_after': '-showfunc -hints +quiet' })
 
     let errorformat =
         \ '%-G%f:%l:%v: %[%#]%[%#]%[%#] Internal Bug %.%#,' .
         \ '%-G%f(%l\,%v): %[%#]%[%#]%[%#] Internal Bug %.%#,' .
diff --git a/syntax_checkers/cpp/verapp.vim b/syntax_checkers/cpp/verapp.vim
index 5e6b8148..1c3a14e9 100644
--- a/syntax_checkers/cpp/verapp.vim
+++ b/syntax_checkers/cpp/verapp.vim
@@ -14,20 +14,18 @@
 if exists('g:loaded_syntastic_cpp_verapp_checker')
     finish
 endif
 let g:loaded_syntastic_cpp_verapp_checker = 1
 
-if !exists('g:syntastic_verapp_config_file')
-    let g:syntastic_verapp_config_file = '.syntastic_verapp_config'
-endif
-
 let s:save_cpo = &cpo
 set cpo&vim
 
 function! SyntaxCheckers_cpp_verapp_GetLocList() dict
+    let buf = bufnr('')
+
     let makeprg = self.makeprgBuild({
-        \ 'args': syntastic#c#ReadConfig(g:syntastic_verapp_config_file),
+        \ 'args': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'verapp_config_file')),
         \ 'args_after': '--show-rule --no-duplicate -S -c -' })
 
     let errorformat = '%f:%t:%l:%c:%m'
 
     return SyntasticMake({
diff --git a/syntax_checkers/cuda/nvcc.vim b/syntax_checkers/cuda/nvcc.vim
index 9601e73a..4fec4a7c 100644
--- a/syntax_checkers/cuda/nvcc.vim
+++ b/syntax_checkers/cuda/nvcc.vim
@@ -8,14 +8,10 @@
 if exists('g:loaded_syntastic_cuda_nvcc_checker')
     finish
 endif
 let g:loaded_syntastic_cuda_nvcc_checker = 1
 
-if !exists('g:syntastic_cuda_config_file')
-    let g:syntastic_cuda_config_file = '.syntastic_cuda_config'
-endif
-
 let s:save_cpo = &cpo
 set cpo&vim
 
 function! SyntaxCheckers_cuda_nvcc_GetLocList() dict
     let buf = bufnr('')
@@ -39,11 +35,11 @@ function! SyntaxCheckers_cuda_nvcc_GetLocList() dict
         endif
     endif
 
     call extend(build_opts, {
         \ 'args_before': arch_flag . ' --cuda -O0 -I .',
-        \ 'args': syntastic#c#ReadConfig(g:syntastic_cuda_config_file),
+        \ 'args': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'cuda_config_file'),
         \ 'args_after': '-Xcompiler -fsyntax-only',
         \ 'tail_after': syntastic#c#NullOutput() })
 
     let makeprg = self.makeprgBuild(build_opts)
 

Vulnerable code:     let config_file = s:_get_checker_var('g', a:ft, a:ck, 'config_file', '.syntastic_' . a:ft . '_config')
Default: ".syntastic_ada_config"
Default: ".syntastic_asm_config"
Default: ".syntastic_avrgcc_config"
Default: ".syntastic_clang_check_config"
Default: ".syntastic_clang_tidy_config"
Default: ".syntastic_cppcheck_config"
Default: ".syntastic_c_config"
Default: ".syntastic_oclint_config"
Default: "options.lnt"
Default: ".syntastic_sparse_config"
Default: ".syntastic_splint_config"
Default: ".syntastic_avrgcc_config"
Default: ".syntastic_clang_check_config"
Default: ".syntastic_clang_tidy_config"
Default: ".syntastic_cppcheck_config"
Default: ".syntastic_cpp_config"
Default: ".syntastic_oclint_config"
Default: "options.lnt"
Default: ".syntastic_verapp_config"
Default: ".syntastic_cobol_config"
Default: ".syntastic_cuda_config"
Default: ".syntastic_d_config"
Default: ".syntastic_fortran_config"
Default: ".syntastic_objc_config"
Default: ".syntastic_oclint_config"
Default: ".syntastic_objcpp_config"
Default: ".syntastic_oclint_config"
Default: ".syntastic_verilog_config"
let g:_SYNTASTIC_VERSION = '3.8.0-110'
if !exists('g:syntastic_avrgcc_config_file')
    let g:syntastic_avrgcc_config_file = '.syntastic_avrgcc_config'
endif

        \ 'args_before': syntastic#c#ReadConfig(g:syntastic_avrgcc_config_file),
if !exists('g:syntastic_clang_check_config_file')
    let g:syntastic_clang_check_config_file = '.syntastic_clang_check_config'
endif

        \   syntastic#c#ReadConfig(g:syntastic_clang_check_config_file) . ' ' .
if !exists('g:syntastic_clang_tidy_config_file')
    let g:syntastic_clang_tidy_config_file = '.syntastic_clang_tidy_config'
endif

        \   syntastic#c#ReadConfig(g:syntastic_clang_tidy_config_file) . ' ' .
if !exists('g:syntastic_cppcheck_config_file')
    let g:syntastic_cppcheck_config_file = '.syntastic_cppcheck_config'
endif

        \ 'args': syntastic#c#ReadConfig(g:syntastic_cppcheck_config_file),
if !exists('g:syntastic_oclint_config_file')
    let g:syntastic_oclint_config_file = '.syntastic_oclint_config'
endif

        \ 'post_args': '-- -c ' . syntastic#c#ReadConfig(g:syntastic_oclint_config_file) })
if !exists('g:syntastic_pc_lint_config_file')
    let g:syntastic_pc_lint_config_file = 'options.lnt'
endif

    let config = syntastic#util#findFileInParent(g:syntastic_pc_lint_config_file, fnamemodify(bufname(buf), ':p:h'))
if !exists('g:syntastic_sparse_config_file')
    let g:syntastic_sparse_config_file = '.syntastic_sparse_config'
endif

        \ 'args': syntastic#c#ReadConfig(g:syntastic_sparse_config_file),
if !exists('g:syntastic_splint_config_file')
    let g:syntastic_splint_config_file = '.syntastic_splint_config'
endif

        \ 'args': syntastic#c#ReadConfig(g:syntastic_splint_config_file),
if !exists('g:syntastic_verapp_config_file')
    let g:syntastic_verapp_config_file = '.syntastic_verapp_config'
endif

        \ 'args': syntastic#c#ReadConfig(g:syntastic_verapp_config_file),
if !exists('g:syntastic_cuda_config_file')
    let g:syntastic_cuda_config_file = '.syntastic_cuda_config'
endif

        \ 'args': syntastic#c#ReadConfig(g:syntastic_cuda_config_file),
Fixed code:     let config_file = s:_get_checker_var('b', a:ft, a:ck, 'config_file', s:_get_checker_var('g', a:ft, a:ck, 'config_file', ''))
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
Default: unset
let g:_SYNTASTIC_VERSION = '3.8.0-113'
    let buf = bufnr('')

        \ 'args_before': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'avrgcc_config_file')),
    let buf = bufnr('')

        \   syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'clang_check_config_file')) . ' ' .
    let buf = bufnr('')

        \   syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'clang_tidy_config_file')) . ' ' .
    let buf = bufnr('')

        \ 'args': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'cppcheck_config_file')),
    let buf = bufnr('')

        \ 'post_args': '-- -c ' . syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'oclint_config_file') })
    let config = syntastic#util#findFileInParent(syntastic#util#bufVar(buf, 'pc_lint_config_file'), fnamemodify(bufname(buf), ':p:h'))
    let buf = bufnr('')

        \ 'args': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'sparse_config_file')),
    let buf = bufnr('')

        \ 'args': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'splint_config_file')),
    let buf = bufnr('')

        \ 'args': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'verapp_config_file')),
        \ 'args': syntastic#c#ReadConfig(syntastic#util#bufVar(buf, 'cuda_config_file'),