From cba3025c438c4be0c5fa5098cabe0129c0e44e96 Mon Sep 17 00:00:00 2001 From: Jan Edmund Lazo Date: Fri, 24 Aug 2018 19:50:55 -0400 Subject: vim-patch:8.0.0883: invalid memory access with nonsensical script Problem: Invalid memory access with nonsensical script. Solution: Check "dstlen" being positive. (Dominique Pelle) https://github.com/vim/vim/commit/1c864093f93b0066de25d6c0ddf03a6bc6b1c870 --- src/nvim/os/env.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) (limited to 'src/nvim/os/env.c') diff --git a/src/nvim/os/env.c b/src/nvim/os/env.c index 6997156d4c..2f90d0bc9e 100644 --- a/src/nvim/os/env.c +++ b/src/nvim/os/env.c @@ -457,12 +457,15 @@ void expand_env_esc(char_u *restrict srcp, } else if ((src[0] == ' ' || src[0] == ',') && !one) { at_start = true; } - *dst++ = *src++; - --dstlen; + if (dstlen > 0) { + *dst++ = *src++; + dstlen--; - if (prefix != NULL && src - prefix_len >= srcp - && STRNCMP(src - prefix_len, prefix, prefix_len) == 0) { - at_start = true; + if (prefix != NULL + && src - prefix_len >= srcp + && STRNCMP(src - prefix_len, prefix, prefix_len) == 0) { + at_start = true; + } } } } -- cgit