From 526dbcafd1cd3eae24e7c615aadef3555b6791aa Mon Sep 17 00:00:00 2001 From: Jan Edmund Lazo Date: Sat, 20 Jul 2019 17:22:17 -0400 Subject: vim-patch:8.1.1720: crash with very long %[] pattern Problem: Crash with very long %[] pattern. (Reza Mirzazade farkhani) Solution: Check for reg_toolong. (closes vim/vim#4703) https://github.com/vim/vim/commit/2a5b52758bb327b89d22660cc28c157ec29782e5 --- src/nvim/regexp.c | 11 +++++++++-- src/nvim/testdir/test_regexp_utf8.vim | 9 +++++++++ 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c index 8598da6376..eb1e565b1f 100644 --- a/src/nvim/regexp.c +++ b/src/nvim/regexp.c @@ -2058,10 +2058,14 @@ static char_u *regatom(int *flagp) EMSG2_RET_NULL(_(e_missing_sb), reg_magic == MAGIC_ALL); br = regnode(BRANCH); - if (ret == NULL) + if (ret == NULL) { ret = br; - else + } else { regtail(lastnode, br); + if (reg_toolong) { + return NULL; + } + } ungetchr(); one_exactly = TRUE; @@ -2083,6 +2087,9 @@ static char_u *regatom(int *flagp) for (br = ret; br != lastnode; ) { if (OP(br) == BRANCH) { regtail(br, lastbranch); + if (reg_toolong) { + return NULL; + } br = OPERAND(br); } else br = regnext(br); diff --git a/src/nvim/testdir/test_regexp_utf8.vim b/src/nvim/testdir/test_regexp_utf8.vim index 97638e9aac..e06c7d6368 100644 --- a/src/nvim/testdir/test_regexp_utf8.vim +++ b/src/nvim/testdir/test_regexp_utf8.vim @@ -183,3 +183,12 @@ func Test_large_class() call assert_equal(1, "\u3042" =~# '[\u3000-\u4000]') set re=0 endfunc + +func Test_optmatch_toolong() + set re=1 + " Can only handle about 8000 characters. + let pat = '\\%[' .. repeat('x', 9000) .. ']' + call assert_fails('call match("abc def", "' .. pat .. '")', 'E339:') + set re=0 +endfunc + -- cgit