diff options
| author | Justin M. Keyes <justinkz@gmail.com> | 2016-04-17 18:25:43 -0400 |
|---|---|---|
| committer | Justin M. Keyes <justinkz@gmail.com> | 2016-04-17 18:25:43 -0400 |
| commit | cc1beecf8149c2eed6e01b415817038609ead123 (patch) | |
| tree | 73e9bf9e1138c2af7e52e7720f737dbee1d57a63 /src | |
| parent | 4043725991dd0f13031c0f6a2929722319425fef (diff) | |
| parent | 164bcaf5c944bfecf3b9bede1e77a52b748f2702 (diff) | |
| download | rneovim-cc1beecf8149c2eed6e01b415817038609ead123.tar.gz rneovim-cc1beecf8149c2eed6e01b415817038609ead123.tar.bz2 rneovim-cc1beecf8149c2eed6e01b415817038609ead123.zip | |
Merge pull request #4592 from oni-link/fix.issue.4582
eval.c: Fix heap corruption error when constructing sourcing_name
Diffstat (limited to 'src')
| -rw-r--r-- | src/nvim/eval.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/src/nvim/eval.c b/src/nvim/eval.c index 51ef777095..0d6e3d3ca3 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -21038,15 +21038,22 @@ call_user_func ( save_sourcing_name = sourcing_name; save_sourcing_lnum = sourcing_lnum; sourcing_lnum = 1; - // need space for function name + ("function " + 3) or "[number]" + // need space for new sourcing_name: + // * save_sourcing_name + // * "["number"].." or "function " + // * "<SNR>" + fp->uf_name - 3 + // * terminating NUL size_t len = (save_sourcing_name == NULL ? 0 : STRLEN(save_sourcing_name)) - + STRLEN(fp->uf_name) + 20; + + STRLEN(fp->uf_name) + 27; sourcing_name = xmalloc(len); { if (save_sourcing_name != NULL && STRNCMP(save_sourcing_name, "function ", 9) == 0) { - vim_snprintf((char *)sourcing_name, len, "%s[%zu]..", - save_sourcing_name, save_sourcing_lnum); + vim_snprintf((char *)sourcing_name, + len, + "%s[%" PRId64 "]..", + save_sourcing_name, + (int64_t)save_sourcing_lnum); } else { STRCPY(sourcing_name, "function "); } |