diff options
| author | Jan Edmund Lazo <jan.lazo@mail.utoronto.ca> | 2019-05-05 09:50:34 -0400 |
|---|---|---|
| committer | Jan Edmund Lazo <jan.lazo@mail.utoronto.ca> | 2019-07-26 05:19:05 -0400 |
| commit | cbda383efefc78f87f8574a960f4c41a8d8107c9 (patch) | |
| tree | a8a1f4ed618cd846cfd293c29c4494c5fb6284f0 | |
| parent | 8a9c9a996322a1d111c55efb156710add68da358 (diff) | |
| download | rneovim-cbda383efefc78f87f8574a960f4c41a8d8107c9.tar.gz rneovim-cbda383efefc78f87f8574a960f4c41a8d8107c9.tar.bz2 rneovim-cbda383efefc78f87f8574a960f4c41a8d8107c9.zip | |
vim-patch:8.1.0404: accessing invalid memory with long argument name
Problem: Accessing invalid memory with long argument name.
Solution: Use item_count instead of checking for a terminating NULL.
(Dominique Pelle, closes vim/vim#3444)
https://github.com/vim/vim/commit/e961cba3cb8281c47f1dc2c2bc031b07504f17d4
| -rw-r--r-- | src/nvim/testdir/test_arglist.vim | 7 | ||||
| -rw-r--r-- | src/nvim/version.c | 2 |
2 files changed, 8 insertions, 1 deletions
diff --git a/src/nvim/testdir/test_arglist.vim b/src/nvim/testdir/test_arglist.vim index 3efef60f8e..7d5511f587 100644 --- a/src/nvim/testdir/test_arglist.vim +++ b/src/nvim/testdir/test_arglist.vim @@ -452,3 +452,10 @@ func Test_arg_all_expand() call assert_equal('notexist Xx\ x runtest.vim', expand('##')) call delete('Xx x') endfunc + +func Test_large_arg() + " Argument longer or equal to the number of columns used to cause + " access to invalid memory. + exe 'argadd ' .repeat('x', &columns) + args +endfunc diff --git a/src/nvim/version.c b/src/nvim/version.c index 28bd22dcb3..baa0df84f4 100644 --- a/src/nvim/version.c +++ b/src/nvim/version.c @@ -2063,7 +2063,7 @@ void list_in_columns(char_u **items, int size, int current) if (Columns < width) { // Not enough screen columns - show one per line - for (i = 0; items[i] != NULL; i++) { + for (i = 0; i < item_count; i++) { version_msg_wrap(items[i], i == current); if (msg_col > 0) { msg_putchar('\n'); |