Mercurial > vim
changeset 24478:460b04d5897f v8.2.2779
patch 8.2.2779: memory access error in remove() for blob
Commit: https://github.com/vim/vim/commit/f7e92aae1581203306a340b4c0059cc74adea9d6
Author: Bram Moolenaar <Bram@vim.org>
Date: Sat Apr 17 21:22:49 2021 +0200
patch 8.2.2779: memory access error in remove() for blob
Problem: Memory access error in remove() for blob.
Solution: Adjust length for memmove().
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Sat, 17 Apr 2021 21:30:03 +0200 |
| parents | 150cc0a3a8d4 |
| children | 22651692d78e |
| files | src/blob.c src/version.c |
| diffstat | 2 files changed, 5 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/src/blob.c +++ b/src/blob.c @@ -444,7 +444,7 @@ blob_remove(typval_T *argvars, typval_T { blob_T *blob; - // Remove range of items, return list with values. + // Remove range of items, return blob with values. end = (long)tv_get_number_chk(&argvars[2], &error); if (error) return; @@ -472,7 +472,8 @@ blob_remove(typval_T *argvars, typval_T rettv->v_type = VAR_BLOB; rettv->vval.v_blob = blob; - mch_memmove(p + idx, p + end + 1, (size_t)(len - end)); + if (len - end - 1 > 0) + mch_memmove(p + idx, p + end + 1, (size_t)(len - end - 1)); b->bv_ga.ga_len -= end - idx + 1; } }