diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2025-03-15 08:16:28 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2025-03-15 08:19:34 +0800 |
| commit | b0b61c42b3abc9fbbe7f3b06914f8022a6154598 (patch) | |
| tree | e6b9abeb67585db4772efd915461855efd147347 | |
| parent | ad5bced63798b99d3e423414ac3ca3ebdc02cbc2 (diff) | |
| download | rneovim-b0b61c42b3abc9fbbe7f3b06914f8022a6154598.tar.gz rneovim-b0b61c42b3abc9fbbe7f3b06914f8022a6154598.tar.bz2 rneovim-b0b61c42b3abc9fbbe7f3b06914f8022a6154598.zip | |
vim-patch:9.0.1458: buffer overflow when expanding long file name
Problem: Buffer overflow when expanding long file name.
Solution: Use a larger buffer and avoid overflowing it. (Yee Cheng Chin,
closes vim/vim#12201)
https://github.com/vim/vim/commit/a77670726e3706973adffc2b118f4576e1f58ea0
Co-authored-by: Yee Cheng Chin <ychin.git@gmail.com>
| -rw-r--r-- | src/nvim/path.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/nvim/path.c b/src/nvim/path.c index d92b9c0f7e..7d623261d2 100644 --- a/src/nvim/path.c +++ b/src/nvim/path.c @@ -627,7 +627,7 @@ static size_t do_path_expand(garray_T *gap, const char *path, size_t wildoff, in // Make room for file name. When doing encoding conversion the actual // length may be quite a bit longer, thus use the maximum possible length. - const size_t buflen = MAXPATHL; + const size_t buflen = strlen(path) + MAXPATHL; char *buf = xmalloc(buflen); // Find the first part in the path name that contains a wildcard. @@ -740,7 +740,7 @@ static size_t do_path_expand(garray_T *gap, const char *path, size_t wildoff, in && ((regmatch.regprog != NULL && vim_regexec(®match, name, 0)) || ((flags & EW_NOTWILD) && path_fnamencmp(path + (s - buf), name, (size_t)(e - s)) == 0))) { - STRCPY(s, name); + xstrlcpy(s, name, buflen - (size_t)(s - buf)); len = strlen(buf); if (starstar && stardepth < 100) { |