diff options
| author | cztchoice <cztchoice@gmail.com> | 2015-07-12 08:09:24 +0800 |
|---|---|---|
| committer | Justin M. Keyes <justinkz@gmail.com> | 2015-07-11 22:38:17 -0400 |
| commit | c80ebfff82d539d44815b1d36709ba573e4e38e8 (patch) | |
| tree | b7fed1b34cfe6ab2ec124afc6e95fbfd9eacdee9 /src/nvim/regexp.c | |
| parent | 366aa8c1963fadabc164e823b6ba758759a30178 (diff) | |
| download | rneovim-c80ebfff82d539d44815b1d36709ba573e4e38e8.tar.gz rneovim-c80ebfff82d539d44815b1d36709ba573e4e38e8.tar.bz2 rneovim-c80ebfff82d539d44815b1d36709ba573e4e38e8.zip | |
vim-patch:7.4.736 #2998
Problem: Invalid memory access.
Solution: Avoid going over the end of a NUL terminated string. (Dominique
Pelle)
https://github.com/vim/vim/commit/v7-4-736
Diffstat (limited to 'src/nvim/regexp.c')
| -rw-r--r-- | src/nvim/regexp.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c index dddd347822..3ae3f46db3 100644 --- a/src/nvim/regexp.c +++ b/src/nvim/regexp.c @@ -1104,7 +1104,7 @@ static int get_coll_element(char_u **pp) int l = 1; char_u *p = *pp; - if (p[1] == '.') { + if (p[0] != NUL && p[1] == '.') { if (has_mbyte) l = (*mb_ptr2len)(p + 2); if (p[l + 2] == '.' && p[l + 3] == ']') { @@ -1156,8 +1156,9 @@ static char_u *skip_anyof(char_u *p) else if (*p == '[') { if (get_char_class(&p) == CLASS_NONE && get_equi_class(&p) == 0 - && get_coll_element(&p) == 0) - ++p; /* It was not a class name */ + && get_coll_element(&p) == 0 + && *p != NUL) + ++p; /* It is not a class name and not NUL */ } else ++p; } @@ -2848,7 +2849,7 @@ static int peekchr(void) /* * META contains everything that may be magic sometimes, * except ^ and $ ("\^" and "\$" are only magic after - * "\v"). We now fetch the next character and toggle its + * "\V"). We now fetch the next character and toggle its * magicness. Therefore, \ is so meta-magic that it is * not in META. */ |