Mercurial > vim
changeset 6830:70fdcdaf96a6 v7.4.736
patch 7.4.736
Problem: Invalid memory access.
Solution: Avoid going over the end of a NUL terminated string. (Dominique
Pelle)
| author | Bram Moolenaar <bram@vim.org> |
|---|---|
| date | Tue, 09 Jun 2015 20:39:24 +0200 |
| parents | 56f553a0bff6 |
| children | 1e4608096d9a |
| files | src/regexp.c src/version.c |
| diffstat | 2 files changed, 7 insertions(+), 4 deletions(-) [+] |
line wrap: on
line diff
--- a/src/regexp.c +++ b/src/regexp.c @@ -1157,7 +1157,7 @@ get_coll_element(pp) int l = 1; char_u *p = *pp; - if (p[1] == '.') + if (p[0] != NUL && p[1] == '.') { #ifdef FEAT_MBYTE if (has_mbyte) @@ -1228,8 +1228,9 @@ skip_anyof(p) { if (get_char_class(&p) == CLASS_NONE && get_equi_class(&p) == 0 - && get_coll_element(&p) == 0) - ++p; /* It was not a class name */ + && get_coll_element(&p) == 0 + && *p != NUL) + ++p; /* it is not a class name and not NUL */ } else ++p; @@ -3156,7 +3157,7 @@ peekchr() /* * META contains everything that may be magic sometimes, * except ^ and $ ("\^" and "\$" are only magic after - * "\v"). We now fetch the next character and toggle its + * "\V"). We now fetch the next character and toggle its * magicness. Therefore, \ is so meta-magic that it is * not in META. */