diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2023-10-07 06:32:06 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-10-07 06:32:06 +0800 |
| commit | 1ac588543ded834b254c7f6a73372583ce89f2ea (patch) | |
| tree | 6c7902fc078d3565364d79dceab8438f600d9da5 | |
| parent | 5db076c7ccfef6732516074252ac4b21b12fc629 (diff) | |
| download | rneovim-1ac588543ded834b254c7f6a73372583ce89f2ea.tar.gz rneovim-1ac588543ded834b254c7f6a73372583ce89f2ea.tar.bz2 rneovim-1ac588543ded834b254c7f6a73372583ce89f2ea.zip | |
vim-patch:9.0.1995: Invalid memory access with empty 'foldexpr' (#25530)
Problem: Invalid memory access when 'foldexpr' returns empty string.
Solution: Check for NUL.
closes: vim/vim#13293
https://github.com/vim/vim/commit/a991ce9c083bb8c02b1b1ec34ed35728197050f3
| -rw-r--r-- | src/nvim/eval.c | 2 | ||||
| -rw-r--r-- | test/old/testdir/test_fold.vim | 9 |
2 files changed, 10 insertions, 1 deletions
diff --git a/src/nvim/eval.c b/src/nvim/eval.c index 9a90e430a7..12226dac91 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -1299,7 +1299,7 @@ int eval_foldexpr(win_T *wp, int *cp) // If the result is a string, check if there is a non-digit before // the number. char *s = tv.vval.v_string; - if (!ascii_isdigit(*s) && *s != '-') { + if (*s != NUL && !ascii_isdigit(*s) && *s != '-') { *cp = (uint8_t)(*s++); } retval = atol(s); diff --git a/test/old/testdir/test_fold.vim b/test/old/testdir/test_fold.vim index ccd1bfecf8..e529a94174 100644 --- a/test/old/testdir/test_fold.vim +++ b/test/old/testdir/test_fold.vim @@ -1569,4 +1569,13 @@ func Test_foldcolumn_linebreak_control_char() bwipe! endfunc +" This used to cause invalid memory access +func Test_foldexpr_return_empty_string() + new + setlocal foldexpr='' foldmethod=expr + redraw + + bwipe! +endfunc + " vim: shiftwidth=2 sts=2 expandtab |