diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/nvim/strings.c | 9 | ||||
| -rw-r--r-- | src/nvim/testdir/test_functions.vim | 10 |
2 files changed, 16 insertions, 3 deletions
diff --git a/src/nvim/strings.c b/src/nvim/strings.c index 3f31914c03..d812aba048 100644 --- a/src/nvim/strings.c +++ b/src/nvim/strings.c @@ -344,14 +344,17 @@ char *strcase_save(const char *const orig, bool upper) char *p = res; while (*p != NUL) { - int l; - int c = utf_ptr2char((const char_u *)p); + int l = utf_ptr2len((const char_u *)p); + if (c == 0) { + // overlong sequence, use only the first byte + c = *p; + l = 1; + } int uc = upper ? mb_toupper(c) : mb_tolower(c); // Reallocate string when byte count changes. This is rare, // thus it's OK to do another malloc()/free(). - l = utf_ptr2len((const char_u *)p); int newl = utf_char2len(uc); if (newl != l) { // TODO(philix): use xrealloc() in strup_save() diff --git a/src/nvim/testdir/test_functions.vim b/src/nvim/testdir/test_functions.vim index 63794a7a85..59445ebfe6 100644 --- a/src/nvim/testdir/test_functions.vim +++ b/src/nvim/testdir/test_functions.vim @@ -299,6 +299,11 @@ func Test_tolower() " Ⱥ (U+023A) and Ⱦ (U+023E) are the *only* code points to increase " in length (2 to 3 bytes) when lowercased. So let's test them. call assert_equal("ⱥ ⱦ", tolower("Ⱥ Ⱦ")) + + " This call to tolower with invalid utf8 sequence used to cause access to + " invalid memory. + call tolower("\xC0\x80\xC0") + call tolower("123\xC0\x80\xC0") endfunc func Test_toupper() @@ -369,6 +374,11 @@ func Test_toupper() call assert_equal("ZŹŻŽƵẐẔ", toupper("ZŹŻŽƵẐẔ")) call assert_equal("Ⱥ Ⱦ", toupper("ⱥ ⱦ")) + + " This call to toupper with invalid utf8 sequence used to cause access to + " invalid memory. + call toupper("\xC0\x80\xC0") + call toupper("123\xC0\x80\xC0") endfunc " Tests for the mode() function |