Mercurial > vim
diff src/spell.c @ 9898:bff8a09016a5 v7.4.2223
commit https://github.com/vim/vim/commit/d3c907b5d2b352482b580a0cf687cbbea4c19ea1
Author: Bram Moolenaar <Bram@vim.org>
Date: Wed Aug 17 21:32:09 2016 +0200
patch 7.4.2223
Problem: Buffer overflow when using latin1 character with feedkeys().
Solution: Check for an illegal character. Add a test.
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Wed, 17 Aug 2016 21:45:07 +0200 |
| parents | fd9727ae3c49 |
| children | 9560a2eb7968 |
line wrap: on
line diff
--- a/src/spell.c +++ b/src/spell.c @@ -5379,7 +5379,7 @@ suggest_trie_walk( #ifdef FEAT_MBYTE if (has_mbyte) { - n = mb_cptr2len(p); + n = MB_CPTR2LEN(p); c = mb_ptr2char(p); if (p[n] == NUL) c2 = NUL; @@ -5477,9 +5477,9 @@ suggest_trie_walk( #ifdef FEAT_MBYTE if (has_mbyte) { - n = mb_cptr2len(p); + n = MB_CPTR2LEN(p); c = mb_ptr2char(p); - fl = mb_cptr2len(p + n); + fl = MB_CPTR2LEN(p + n); c2 = mb_ptr2char(p + n); if (!soundfold && !spell_iswordp(p + n + fl, curwin)) c3 = c; /* don't swap non-word char */ @@ -5596,10 +5596,10 @@ suggest_trie_walk( #ifdef FEAT_MBYTE if (has_mbyte) { - n = mb_cptr2len(p); + n = MB_CPTR2LEN(p); c = mb_ptr2char(p); - fl = mb_cptr2len(p + n); - fl += mb_cptr2len(p + n + fl); + fl = MB_CPTR2LEN(p + n); + fl += MB_CPTR2LEN(p + n + fl); mch_memmove(p, p + n, fl); mb_char2bytes(c, p + fl); stack[depth].ts_fidxtry = sp->ts_fidx + n + fl; @@ -5661,10 +5661,10 @@ suggest_trie_walk( #ifdef FEAT_MBYTE if (has_mbyte) { - n = mb_cptr2len(p); - n += mb_cptr2len(p + n); + n = MB_CPTR2LEN(p); + n += MB_CPTR2LEN(p + n); c = mb_ptr2char(p + n); - tl = mb_cptr2len(p + n); + tl = MB_CPTR2LEN(p + n); mch_memmove(p + tl, p, n); mb_char2bytes(c, p); stack[depth].ts_fidxtry = sp->ts_fidx + n + tl; @@ -5955,8 +5955,8 @@ find_keepcap_word(slang_T *slang, char_u #ifdef FEAT_MBYTE if (has_mbyte) { - flen = mb_cptr2len(fword + fwordidx[depth]); - ulen = mb_cptr2len(uword + uwordidx[depth]); + flen = MB_CPTR2LEN(fword + fwordidx[depth]); + ulen = MB_CPTR2LEN(uword + uwordidx[depth]); } else #endif