diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2022-02-18 08:29:55 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2022-02-18 09:48:00 +0800 |
| commit | 3ed800e998e22a975e17ee54e675410148850c75 (patch) | |
| tree | f1c487fb51e6d589ec8c6ad504214d93b01d0146 /src/nvim/ex_docmd.c | |
| parent | 592f4a7c0807427355635eb371215036325e5bb8 (diff) | |
| download | rneovim-3ed800e998e22a975e17ee54e675410148850c75.tar.gz rneovim-3ed800e998e22a975e17ee54e675410148850c75.tar.bz2 rneovim-3ed800e998e22a975e17ee54e675410148850c75.zip | |
vim-patch:8.2.3659: integer overflow with large line number
Problem: Integer overflow with large line number.
Solution: Check for overflow. (closes vim/vim#9202)
https://github.com/vim/vim/commit/03725c5795ae5b8c14da4a39cd0ce723c6dd4304
Put E1247 in globals.h as E1240 is also there.
Do not make getdigits() abort.
Diffstat (limited to 'src/nvim/ex_docmd.c')
| -rw-r--r-- | src/nvim/ex_docmd.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c index 9991584862..e8b8dc799c 100644 --- a/src/nvim/ex_docmd.c +++ b/src/nvim/ex_docmd.c @@ -4141,7 +4141,11 @@ static linenr_T get_address(exarg_T *eap, char_u **ptr, cmd_addr_T addr_type, in if (!ascii_isdigit(*cmd)) { // '+' is '+1', but '+0' is not '+1' n = 1; } else { - n = getdigits(&cmd, true, 0); + n = getdigits(&cmd, false, MAXLNUM); + if (n == MAXLNUM) { + emsg(_(e_line_number_out_of_range)); + goto error; + } } if (addr_type == ADDR_TABS_RELATIVE) { @@ -4160,6 +4164,10 @@ static linenr_T get_address(exarg_T *eap, char_u **ptr, cmd_addr_T addr_type, in if (i == '-') { lnum -= n; } else { + if (n >= LONG_MAX - lnum) { + emsg(_(e_line_number_out_of_range)); + goto error; + } lnum += n; } } |