Merge pull request #12376 from erw7/fix-stack-overflow-on-input-enqueue

input: fix stack overflow

1 files changed, 7 insertions, 2 deletions

diff --git a/src/nvim/os/input.c b/src/nvim/os/input.c
index c1580c5fc3..b7878d9da8 100644
--- a/src/nvim/os/input.c
+++ b/src/nvim/os/input.c
@@ -188,8 +188,13 @@ size_t input_enqueue(String keys)
   char *ptr = keys.data;
   char *end = ptr + keys.size;
 
-  while (rbuffer_space(input_buffer) >= 6 && ptr < end) {
-    uint8_t buf[6] = { 0 };
+  while (rbuffer_space(input_buffer) >= 19 && ptr < end) {
+    // A "<x>" form occupies at least 1 characters, and produces up
+    // to 19 characters (1 + 5 * 3 for the char and 3 for a modifier).
+    // In the case of K_SPECIAL(0x80) or CSI(0x9B), 3 bytes are escaped and
+    // needed, but since the keys are UTF-8, so the first byte cannot be
+    // K_SPECIAL(0x80) or CSI(0x9B).
+    uint8_t buf[19] = { 0 };
     unsigned int new_size
         = trans_special((const uint8_t **)&ptr, (size_t)(end - ptr), buf, true,
                         false);