Mercurial > vim
diff src/regexp.c @ 15959:4feaa025491b v8.1.0985
patch 8.1.0985: crash with large number in regexp
commit https://github.com/vim/vim/commit/ab350f89f9646e07aefe16a32ba3ddb847496b4a
Author: Bram Moolenaar <Bram@vim.org>
Date: Thu Feb 28 06:25:00 2019 +0100
patch 8.1.0985: crash with large number in regexp
Problem: Crash with large number in regexp. (Kuang-che Wu)
Solution: Check for long becoming negative int. (closes #)
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Thu, 28 Feb 2019 06:30:11 +0100 |
| parents | ff00d207cc5e |
| children | ddd82b1c9e9d |
line wrap: on
line diff
--- a/src/regexp.c +++ b/src/regexp.c @@ -2228,7 +2228,7 @@ regatom(int *flagp) default: i = -1; break; } - if (i < 0) + if (i < 0 || i > INT_MAX) EMSG2_RET_NULL( _("E678: Invalid character after %s%%[dxouU]"), reg_magic == MAGIC_ALL); @@ -3293,7 +3293,7 @@ coll_get_char(void) case 'u': nr = gethexchrs(4); break; case 'U': nr = gethexchrs(8); break; } - if (nr < 0) + if (nr < 0 || nr > INT_MAX) { /* If getting the number fails be backwards compatible: the character * is a backslash. */