Mercurial > vim
changeset 28905:f3f45218f923 v8.2.4975
patch 8.2.4975: recursive command line loop may cause a crash
Commit: https://github.com/vim/vim/commit/51f0bfb88a3554ca2dde777d78a59880d1ee37a8
Author: Bram Moolenaar <Bram@vim.org>
Date: Tue May 17 20:11:02 2022 +0100
patch 8.2.4975: recursive command line loop may cause a crash
Problem: Recursive command line loop may cause a crash.
Solution: Limit recursion of getcmdline().
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Tue, 17 May 2022 21:15:03 +0200 |
| parents | 02398ff5b522 |
| children | d43069214fa6 |
| files | src/ex_getln.c src/testdir/test_cmdline.vim src/version.c |
| diffstat | 3 files changed, 26 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/src/ex_getln.c +++ b/src/ex_getln.c @@ -1581,6 +1581,7 @@ getcmdline_int( int indent, // indent for inside conditionals int clear_ccline) // clear ccline first { + static int depth = 0; // call depth int c; int i; int j; @@ -1611,6 +1612,9 @@ getcmdline_int( int cmdline_type; int wild_type; + // one recursion level deeper + ++depth; + if (ccline.cmdbuff != NULL) { // Being called recursively. Since ccline is global, we need to save @@ -1641,6 +1645,13 @@ getcmdline_int( if (init_ccline(firstc, indent) != OK) goto theend; // out of memory + if (depth == 50) + { + // Somehow got into a loop recursively calling getcmdline(), bail out. + emsg(_(e_command_too_recursive)); + goto theend; + } + ExpandInit(&xpc); ccline.xpc = &xpc; @@ -2576,6 +2587,7 @@ theend: { char_u *p = ccline.cmdbuff; + --depth; if (did_save_ccline) restore_cmdline(&save_ccline); else
--- a/src/testdir/test_cmdline.vim +++ b/src/testdir/test_cmdline.vim @@ -3392,4 +3392,16 @@ func Test_screenpos_and_completion() call feedkeys(":let a\<C-R>=Check_completion()\<CR>\<Esc>", "xt") endfunc +func Test_recursive_register() + let @= = '' + silent! ? e/ + let caught = 'no' + try + normal // + catch /E169:/ + let caught = 'yes' + endtry + call assert_equal('yes', caught) +endfunc + " vim: shiftwidth=2 sts=2 expandtab