diff options
author | Justin M. Keyes <justinkz@gmail.com> | 2018-02-02 01:34:10 +0100 |
---|---|---|
committer | Justin M. Keyes <justinkz@gmail.com> | 2018-02-11 15:27:56 +0100 |
commit | 4c1afd1e83cee67bf447c64f9042331f0ee5d103 (patch) | |
tree | a7fd366c5ba1ef16924f7f14ec6ae5078f5ce4ce /src/nvim/memline.c | |
parent | fafe23cad70b3a20bcf3d4417a5d1fe93cd8e747 (diff) | |
download | rneovim-4c1afd1e83cee67bf447c64f9042331f0ee5d103.tar.gz rneovim-4c1afd1e83cee67bf447c64f9042331f0ee5d103.tar.bz2 rneovim-4c1afd1e83cee67bf447c64f9042331f0ee5d103.zip |
vim-patch:8.0.0337: invalid memory access in :recover command
Problem: Invalid memory access in :recover command.
Solution: Avoid access before directory name. (Dominique Pelle,
closes vim/vim#1488)
https://github.com/vim/vim/commit/c525e3a1c20f6b5d9809c8b84f80090a8e416c92
Diffstat (limited to 'src/nvim/memline.c')
-rw-r--r-- | src/nvim/memline.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/src/nvim/memline.c b/src/nvim/memline.c index 80775c607d..f783dd84c5 100644 --- a/src/nvim/memline.c +++ b/src/nvim/memline.c @@ -1330,9 +1330,12 @@ recover_names ( names[2] = (char_u *)concat_fnames((char *)dir_name, ".sw?", TRUE); num_names = 3; } else { - p = dir_name + STRLEN(dir_name); - if (after_pathsep((char *)dir_name, (char *)p) && p[-1] == p[-2]) { - /* Ends with '//', Use Full path for swap name */ + int len = STRLEN(dir_name); + p = dir_name + len; + if (after_pathsep((char *)dir_name, (char *)p) + && len > 1 + && p[-1] == p[-2]) { + // Ends with '//', Use Full path for swap name tail = (char_u *)make_percent_swname((char *)dir_name, (char *)fname_res); } else { tail = path_tail(fname_res); @@ -3054,9 +3057,12 @@ char_u *makeswapname(char_u *fname, char_u *ffname, buf_T *buf, char_u *dir_name #ifdef HAVE_READLINK char_u fname_buf[MAXPATHL]; #endif + int len = STRLEN(dir_name); - s = dir_name + STRLEN(dir_name); - if (after_pathsep((char *)dir_name, (char *)s) && s[-1] == s[-2]) { /* Ends with '//', Use Full path */ + s = dir_name + len; + if (after_pathsep((char *)dir_name, (char *)s) + && len > 1 + && s[-1] == s[-2]) { // Ends with '//', Use Full path r = NULL; if ((s = (char_u *)make_percent_swname((char *)dir_name, (char *)fname)) != NULL) { r = (char_u *)modname((char *)s, ".swp", FALSE); |