diff options
author | zeertzjq <zeertzjq@outlook.com> | 2022-02-18 08:29:55 +0800 |
---|---|---|
committer | zeertzjq <zeertzjq@outlook.com> | 2022-02-18 09:48:00 +0800 |
commit | 3ed800e998e22a975e17ee54e675410148850c75 (patch) | |
tree | f1c487fb51e6d589ec8c6ad504214d93b01d0146 /src/nvim/normal.c | |
parent | 592f4a7c0807427355635eb371215036325e5bb8 (diff) | |
download | rneovim-3ed800e998e22a975e17ee54e675410148850c75.tar.gz rneovim-3ed800e998e22a975e17ee54e675410148850c75.tar.bz2 rneovim-3ed800e998e22a975e17ee54e675410148850c75.zip |
vim-patch:8.2.3659: integer overflow with large line number
Problem: Integer overflow with large line number.
Solution: Check for overflow. (closes vim/vim#9202)
https://github.com/vim/vim/commit/03725c5795ae5b8c14da4a39cd0ce723c6dd4304
Put E1247 in globals.h as E1240 is also there.
Do not make getdigits() abort.
Diffstat (limited to 'src/nvim/normal.c')
-rw-r--r-- | src/nvim/normal.c | 17 |
1 files changed, 7 insertions, 10 deletions
diff --git a/src/nvim/normal.c b/src/nvim/normal.c index 21c465434a..a50f85dc7a 100644 --- a/src/nvim/normal.c +++ b/src/nvim/normal.c @@ -824,15 +824,12 @@ static bool normal_get_command_count(NormalState *s) if (s->c == K_DEL || s->c == K_KDEL) { s->ca.count0 /= 10; del_from_showcmd(4); // delete the digit and ~@% + } else if (s->ca.count0 >= 999999999L) { + s->ca.count0 = 999999999L; } else { s->ca.count0 = s->ca.count0 * 10 + (s->c - '0'); } - if (s->ca.count0 < 0) { - // overflow - s->ca.count0 = 999999999L; - } - // Set v:count here, when called from main() and not a stuffed // command, so that v:count can be used in an expression mapping // right after the count. Do set it for redo. @@ -1046,14 +1043,14 @@ static int normal_execute(VimState *state, int key) // If you give a count before AND after the operator, they are // multiplied. if (s->ca.count0) { - s->ca.count0 = (long)((uint64_t)s->ca.count0 * (uint64_t)s->ca.opcount); + if (s->ca.opcount >= 999999999L / s->ca.count0) { + s->ca.count0 = 999999999L; + } else { + s->ca.count0 *= s->ca.opcount; + } } else { s->ca.count0 = s->ca.opcount; } - if (s->ca.count0 < 0) { - // overflow - s->ca.count0 = 999999999L; - } } // Always remember the count. It will be set to zero (on the next call, |