diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2022-02-18 10:15:08 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-02-18 10:15:08 +0800 |
| commit | faeff49cbfd190afba67e221412b7132b7ad8360 (patch) | |
| tree | bb6260556f056982e51f6dda99bd882e650cafcc /src/nvim/ex_docmd.c | |
| parent | 592f4a7c0807427355635eb371215036325e5bb8 (diff) | |
| parent | 62a1290758a3cd6af95dc47a3bbdc7dcf290d531 (diff) | |
| download | rneovim-faeff49cbfd190afba67e221412b7132b7ad8360.tar.gz rneovim-faeff49cbfd190afba67e221412b7132b7ad8360.tar.bz2 rneovim-faeff49cbfd190afba67e221412b7132b7ad8360.zip | |
Merge pull request #17449 from zeertzjq/vim-8.2.3659
vim-patch:8.2.{3659,3660,3661}: integer overflow with large line number
Diffstat (limited to 'src/nvim/ex_docmd.c')
| -rw-r--r-- | src/nvim/ex_docmd.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c index 9991584862..e8b8dc799c 100644 --- a/src/nvim/ex_docmd.c +++ b/src/nvim/ex_docmd.c @@ -4141,7 +4141,11 @@ static linenr_T get_address(exarg_T *eap, char_u **ptr, cmd_addr_T addr_type, in if (!ascii_isdigit(*cmd)) { // '+' is '+1', but '+0' is not '+1' n = 1; } else { - n = getdigits(&cmd, true, 0); + n = getdigits(&cmd, false, MAXLNUM); + if (n == MAXLNUM) { + emsg(_(e_line_number_out_of_range)); + goto error; + } } if (addr_type == ADDR_TABS_RELATIVE) { @@ -4160,6 +4164,10 @@ static linenr_T get_address(exarg_T *eap, char_u **ptr, cmd_addr_T addr_type, in if (i == '-') { lnum -= n; } else { + if (n >= LONG_MAX - lnum) { + emsg(_(e_line_number_out_of_range)); + goto error; + } lnum += n; } } |