diff options
| author | Jan Edmund Lazo <janedmundlazo@hotmail.com> | 2018-08-24 19:50:55 -0400 |
|---|---|---|
| committer | Jan Edmund Lazo <janedmundlazo@hotmail.com> | 2018-08-24 20:03:29 -0400 |
| commit | cba3025c438c4be0c5fa5098cabe0129c0e44e96 (patch) | |
| tree | 54d7afbc34f933aaf9d7232b63be7ad1a42b5817 | |
| parent | c0157e8fe0b9b25d9004b3f10a0ef5d33e4ff027 (diff) | |
| download | rneovim-cba3025c438c4be0c5fa5098cabe0129c0e44e96.tar.gz rneovim-cba3025c438c4be0c5fa5098cabe0129c0e44e96.tar.bz2 rneovim-cba3025c438c4be0c5fa5098cabe0129c0e44e96.zip | |
vim-patch:8.0.0883: invalid memory access with nonsensical script
Problem: Invalid memory access with nonsensical script.
Solution: Check "dstlen" being positive. (Dominique Pelle)
https://github.com/vim/vim/commit/1c864093f93b0066de25d6c0ddf03a6bc6b1c870
| -rw-r--r-- | src/nvim/os/env.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/src/nvim/os/env.c b/src/nvim/os/env.c index 6997156d4c..2f90d0bc9e 100644 --- a/src/nvim/os/env.c +++ b/src/nvim/os/env.c @@ -457,12 +457,15 @@ void expand_env_esc(char_u *restrict srcp, } else if ((src[0] == ' ' || src[0] == ',') && !one) { at_start = true; } - *dst++ = *src++; - --dstlen; + if (dstlen > 0) { + *dst++ = *src++; + dstlen--; - if (prefix != NULL && src - prefix_len >= srcp - && STRNCMP(src - prefix_len, prefix, prefix_len) == 0) { - at_start = true; + if (prefix != NULL + && src - prefix_len >= srcp + && STRNCMP(src - prefix_len, prefix, prefix_len) == 0) { + at_start = true; + } } } } |