Mercurial > vim

comparison src/regexp.c @ 15959:4feaa025491b v8.1.0985

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 8.1.0985: crash with large number in regexp commit https://github.com/vim/vim/commit/ab350f89f9646e07aefe16a32ba3ddb847496b4a Author: Bram Moolenaar <Bram@vim.org> Date: Thu Feb 28 06:25:00 2019 +0100 patch 8.1.0985: crash with large number in regexp Problem: Crash with large number in regexp. (Kuang-che Wu) Solution: Check for long becoming negative int. (closes #)
author Bram Moolenaar <Bram@vim.org>
date Thu, 28 Feb 2019 06:30:11 +0100
parents ff00d207cc5e
children ddd82b1c9e9d
comparison
equal deleted inserted replaced
15958:5b3c0bb37ebc 15959:4feaa025491b
2226 case 'u': i = gethexchrs(4); break; 2226 case 'u': i = gethexchrs(4); break;
2227 case 'U': i = gethexchrs(8); break; 2227 case 'U': i = gethexchrs(8); break;
2228 default: i = -1; break; 2228 default: i = -1; break;
2229 } 2229 }
2230 2230
2231 if (i < 0) 2231 if (i < 0 || i > INT_MAX)
2232 EMSG2_RET_NULL( 2232 EMSG2_RET_NULL(
2233 _("E678: Invalid character after %s%%[dxouU]"), 2233 _("E678: Invalid character after %s%%[dxouU]"),
2234 reg_magic == MAGIC_ALL); 2234 reg_magic == MAGIC_ALL);
2235 if (use_multibytecode(i)) 2235 if (use_multibytecode(i))
2236 ret = regnode(MULTIBYTECODE); 2236 ret = regnode(MULTIBYTECODE);
3291 case 'o': nr = getoctchrs(); break; 3291 case 'o': nr = getoctchrs(); break;
3292 case 'x': nr = gethexchrs(2); break; 3292 case 'x': nr = gethexchrs(2); break;
3293 case 'u': nr = gethexchrs(4); break; 3293 case 'u': nr = gethexchrs(4); break;
3294 case 'U': nr = gethexchrs(8); break; 3294 case 'U': nr = gethexchrs(8); break;
3295 } 3295 }
3296 if (nr < 0) 3296 if (nr < 0 || nr > INT_MAX)
3297 { 3297 {
3298 /* If getting the number fails be backwards compatible: the character 3298 /* If getting the number fails be backwards compatible: the character
3299 * is a backslash. */ 3299 * is a backslash. */
3300 --regparse; 3300 --regparse;
3301 nr = '\\'; 3301 nr = '\\';