changeset 26773:80e134cbee4b v8.2.3915

patch 8.2.3915: illegal memory access when completing with invalid bytes Commit: https://github.com/vim/vim/commit/4b28ba3245df8274303c79429972f9dc9438e4aa Author: Bram Moolenaar <Bram@vim.org> Date: Mon Dec 27 19:28:37 2021 +0000 patch 8.2.3915: illegal memory access when completing with invalid bytes Problem: illegal memory access when completing with invalid bytes. Solution: Avoid going over the end of the completion text.
author Bram Moolenaar <Bram@vim.org>
date Mon, 27 Dec 2021 20:30:03 +0100
parents 0a31b0ba0fd6
children 73cedd119ce2
files src/insexpand.c src/testdir/test_ins_complete.vim src/version.c
diffstat 3 files changed, 21 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/src/insexpand.c
+++ b/src/insexpand.c
@@ -3437,7 +3437,12 @@ ins_compl_delete(void)
     void
 ins_compl_insert(int in_compl_func)
 {
-    ins_bytes(compl_shown_match->cp_str + ins_compl_len());
+    int compl_len = ins_compl_len();
+
+    // Make sure we don't go over the end of the string, this can happen with
+    // illegal bytes.
+    if (compl_len < (int)STRLEN(compl_shown_match->cp_str))
+	ins_bytes(compl_shown_match->cp_str + compl_len);
     if (compl_shown_match->cp_flags & CP_ORIGINAL_TEXT)
 	compl_used_match = FALSE;
     else
--- a/src/testdir/test_ins_complete.vim
+++ b/src/testdir/test_ins_complete.vim
@@ -103,6 +103,19 @@ func Test_ins_complete()
   call delete('Xdir', 'rf')
 endfunc
 
+func Test_ins_complete_invalid_byte()
+  if has('unix') && executable('base64')
+    " this weird command was causing an illegal memory access
+    call writefile(['bm9ybTlvMDCAMM4Dbw4OGA4ODg=='], 'Xinvalid64')
+    call system('base64 -d Xinvalid64 > Xinvalid')
+    call writefile(['qa!'], 'Xexit')
+    call RunVim([], [], " -i NONE -n -X -Z -e -m -s -S Xinvalid -S Xexit")
+    call delete('Xinvalid64')
+    call delete('Xinvalid')
+    call delete('Xexit')
+  endif
+endfunc
+
 func Test_omni_dash()
   func Omni(findstart, base)
     if a:findstart
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    3915,
+/**/
     3914,
 /**/
     3913,