Mercurial > vim
comparison src/misc1.c @ 12005:0496ea4c5c2e v8.0.0883
patch 8.0.0883: invalid memory access with nonsensical script
commit https://github.com/vim/vim/commit/1c864093f93b0066de25d6c0ddf03a6bc6b1c870
Author: Bram Moolenaar <Bram@vim.org>
Date: Sun Aug 6 18:15:45 2017 +0200
patch 8.0.0883: invalid memory access with nonsensical script
Problem: Invalid memory access with nonsensical script.
Solution: Check "dstlen" being positive. (Dominique Pelle)
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 06 Aug 2017 19:15:04 +0200 |
| parents | 0aae4df3ed8e |
| children | 0066a7e178bc |
comparison
equal
deleted
inserted
replaced
| 12004:2b8cb306954f | 12005:0496ea4c5c2e |
|---|---|
| 4178 *dst++ = *src++; | 4178 *dst++ = *src++; |
| 4179 --dstlen; | 4179 --dstlen; |
| 4180 } | 4180 } |
| 4181 else if ((src[0] == ' ' || src[0] == ',') && !one) | 4181 else if ((src[0] == ' ' || src[0] == ',') && !one) |
| 4182 at_start = TRUE; | 4182 at_start = TRUE; |
| 4183 *dst++ = *src++; | 4183 if (dstlen > 0) |
| 4184 --dstlen; | 4184 { |
| 4185 | 4185 *dst++ = *src++; |
| 4186 if (startstr != NULL && src - startstr_len >= srcp | 4186 --dstlen; |
| 4187 && STRNCMP(src - startstr_len, startstr, startstr_len) == 0) | 4187 |
| 4188 at_start = TRUE; | 4188 if (startstr != NULL && src - startstr_len >= srcp |
| 4189 } | 4189 && STRNCMP(src - startstr_len, startstr, |
| 4190 startstr_len) == 0) | |
| 4191 at_start = TRUE; | |
| 4192 } | |
| 4193 } | |
| 4194 | |
| 4190 } | 4195 } |
| 4191 *dst = NUL; | 4196 *dst = NUL; |
| 4192 } | 4197 } |
| 4193 | 4198 |
| 4194 /* | 4199 /* |