aboutsummaryrefslogtreecommitdiff
path: root/src/nvim/normal.c
diff options
context:
space:
mode:
authorzeertzjq <zeertzjq@outlook.com>2022-02-18 08:29:55 +0800
committerzeertzjq <zeertzjq@outlook.com>2022-02-18 09:48:00 +0800
commit3ed800e998e22a975e17ee54e675410148850c75 (patch)
treef1c487fb51e6d589ec8c6ad504214d93b01d0146 /src/nvim/normal.c
parent592f4a7c0807427355635eb371215036325e5bb8 (diff)
downloadrneovim-3ed800e998e22a975e17ee54e675410148850c75.tar.gz
rneovim-3ed800e998e22a975e17ee54e675410148850c75.tar.bz2
rneovim-3ed800e998e22a975e17ee54e675410148850c75.zip
vim-patch:8.2.3659: integer overflow with large line number
Problem: Integer overflow with large line number. Solution: Check for overflow. (closes vim/vim#9202) https://github.com/vim/vim/commit/03725c5795ae5b8c14da4a39cd0ce723c6dd4304 Put E1247 in globals.h as E1240 is also there. Do not make getdigits() abort.
Diffstat (limited to 'src/nvim/normal.c')
-rw-r--r--src/nvim/normal.c17
1 files changed, 7 insertions, 10 deletions
diff --git a/src/nvim/normal.c b/src/nvim/normal.c
index 21c465434a..a50f85dc7a 100644
--- a/src/nvim/normal.c
+++ b/src/nvim/normal.c
@@ -824,15 +824,12 @@ static bool normal_get_command_count(NormalState *s)
if (s->c == K_DEL || s->c == K_KDEL) {
s->ca.count0 /= 10;
del_from_showcmd(4); // delete the digit and ~@%
+ } else if (s->ca.count0 >= 999999999L) {
+ s->ca.count0 = 999999999L;
} else {
s->ca.count0 = s->ca.count0 * 10 + (s->c - '0');
}
- if (s->ca.count0 < 0) {
- // overflow
- s->ca.count0 = 999999999L;
- }
-
// Set v:count here, when called from main() and not a stuffed
// command, so that v:count can be used in an expression mapping
// right after the count. Do set it for redo.
@@ -1046,14 +1043,14 @@ static int normal_execute(VimState *state, int key)
// If you give a count before AND after the operator, they are
// multiplied.
if (s->ca.count0) {
- s->ca.count0 = (long)((uint64_t)s->ca.count0 * (uint64_t)s->ca.opcount);
+ if (s->ca.opcount >= 999999999L / s->ca.count0) {
+ s->ca.count0 = 999999999L;
+ } else {
+ s->ca.count0 *= s->ca.opcount;
+ }
} else {
s->ca.count0 = s->ca.opcount;
}
- if (s->ca.count0 < 0) {
- // overflow
- s->ca.count0 = 999999999L;
- }
}
// Always remember the count. It will be set to zero (on the next call,