changeset 29525:5063dfe96a59 v9.0.0104

patch 9.0.0104: going beyond allocated memory when evaluating string constant Commit: https://github.com/vim/vim/commit/1e56bda9048a9625bce6e660938c834c5c15b07d Author: Bram Moolenaar <Bram@vim.org> Date: Fri Jul 29 15:28:27 2022 +0100 patch 9.0.0104: going beyond allocated memory when evaluating string constant Problem: Going beyond allocated memory when evaluating string constant. Solution: Properly skip over <Key> form.
author Bram Moolenaar <Bram@vim.org>
date Fri, 29 Jul 2022 16:30:04 +0200
parents db3afe53702b
children 575f2686d4a8
files src/testdir/test_eval_stuff.vim src/typval.c src/version.c
diffstat 3 files changed, 14 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
index 3c168f2f59b58599dd68c262a83e472838c08c43..c63082e8e8b6dcc823d2fee3f3054ee363e8f11e
GIT binary patch
literal 23684
zc%02#>vHS3k<Q=v0cQVVnCzjvYs(@fU(0f>FY=6QCz;fo)TybmT`H1-B<4`0mZW^i
znW@Ut>?7<8?3?6C(zp;85}@dFGBxqckw~Ds@pYroXn-Od^k-a@1)66$dJ6J5+Y|^t
z1qmvbak?n_J3B?T$s>%OV*EValyTC3idQ>3^GzC+ah9UuY@TJkT@-{_UhW`N=CAOH
zP>#z@o}&9lG#;Y?6h%Q9E!8RyZg4sy4DeM6WTGjmDP@^5^67J2E~hxpv%I%U#U%*}
ziUQ~56#vgANP6C01!lJrs0vH7N?cK9Ii41Af>YpK6$>hm-G40<D3^KmOhH!2Ias)e
zmKh*H?sJ}{3luDZICYJfG>Sd+KFTppzl&4cdzZjxVTQW;IE(Y?TIxv)dhU<(`vCY#
zJOgp=+O3<S%s03f7eIz1Q1i9Uw7aYHk%Ru6zd|>oGDEB2BS!coE=p2R@yED8vkVuh
zTOw+E%Gbms!E{6n7DWe><KgMqfn?%3<aiCf)N`4Pe!stmoVBxy<^gokjJj%&HnF}^
z(V~+a(wG2WY}RY&`2w5|oSUjrRHl2*;}Xw7cJKZXApS@$8-^u~7d=-|&Y^@314neD
z>PW^JPH>5Pb$Oy#7%rbTT4UZb*yBx=)PXliGA+s+bOsmSj_>}lLNz$+qD~M-pbRmA
z;2a$iPJ@RM=bc7b3LUTs$grip3W}j1&x2PqM)!w%JHK@vP`pTCw2^R9?ELlt9kJ3C
zEz5YVEFvFD@dJ9KbwN5qMYdw~MpHp^=m?<G=8cdir$<AI61;wi3yh*{wF1Ef+7#eb
z&}tOG6>+UNEpeV!euCBz7IQ)Xkq@2pz5d|vXvo!lnqpA)=}dSOE6iwNmdr@s7e?DV
zl#(-!UDqKN2aL_WVj4nAdxGBFom^zqY$u`Fp2A@?9E`VVoWh(C&l-`Jw@ZfP3z!X^
zp3)Y*!Rd+3=Ol3z@*zsbX_~vcZ{Ypp2JRU;{aIrHo_J0t8-xzLgTn*=pg4F)SyYJU
zJ7nsa<-xN_ONa~92GcN31BjahK#HF$7zHkg&yz{!-px`>#z*;_(XS;0b@!3ZAwUJw
zOoHa~@hmIEtinPJ`tb*)5$-E=8USx`wMuvYq5@=@?JOwvn84kdbRn$P3^2k!ze5wB
zAvv@--Ms^HA94~oK{CG}@Y$vFSxwossJAA?1AX`$ukqK7*sRGnj*6PUKpwF!Uu9p_
z=M-AKFJ=M~gJLD}WUF-m;ct`1X<WuI)cy(;D-7Z8m3aFH2t4Owh&_IPG&nl6^cLwO
z#YRe#tTUQZkcO&N$!ulR&3V|&@qB*!{rAMa@Wt-0E`M;S+CL})Y~J7k8$k$Pz*kd3
z7tqw8)<ByMtKh|?Lms3HI<7~%8e$-~BK8Pg-v*U%Rs+i>VMr)O+a>J#ZAvqYrui9{
zBv-C-Tf@vRW*?v-)AggCE7YppdV2f0QVdvGN<*><NDFZ)(+NX59gu+zp}%hpE`kJg
zpy}I#lp==_ZIRRoQ5Q(vFiB7}=_1ArTz(glyU-PN{V@t#<OLQnL4W*NYyj?a8|=~|
z%<#(qTyLIaLCKdKLe`}#?uiw=zCRo_))!pnC9NfLi8;evktPTqb*O`)dHg~b9dS`?
zF#6r-aB!@;@5gvO4d#$BPU(`dr>?NrBGM(fD_u}acrO4C(w-<wVDbFZPv~7)$c2%h
zKWMCxVL=|{@w$A%c|q3SzHKB;H9EgBqUcJIS`yM)M!WB`5NmfSa}*%!VPZu@-E-m{
zTGt!WAt~kQNjoV4&$_Ws1LkCOq9l4oH<$x`|IpIsgFY-1=7yfuZR&Nisn^M-UI&{>
z1J(y^-3sR6;rYZogwARki-noFv~FuP%}_DT(^HV^78!Q3$k4T|Ua1|pEQZPVOb(J1
zxJTFjL@p;6R<59q`R0vbpNNy}b{SMnEiGfo2uRha-Oo8>=H^G%1=|^?Rg~CDSY0M$
zFX{k!1Nbwlpi^F;lY!?Q`iI68V-`o{G>9Tx6ejb~#Qls!xlisq%V4qQ{oD*6q$3CD
z-8(|s2QninPb08&*{HS4Mx7jU)O1YlGRJ#p;2m2kA*Kwn*4po_wI@XIiMjI7^N8f*
zV+-@q2&zNR9Sqq2mL>+Hlf&a9Abs&#35Wji(Fs*$i#+<bhe*SO%tGftP#VFi0Ked9
z18J*6hl1yl(%t<F2&=1}#oVrk5SyCo%<bHKlc1t?832ePp1zM|kM>Q^X$E<vUw>7X
zFs0Hea%v9as?F66aO%>v8oy<Awpp1!4X6>*x%||)`B|50K+QXO8m(q*m!Ir(+SV<c
z7|AWs1j24_`&MU@kwh@TXq;y(jA4?6obmLShw3I(wN=|y>N?2D(!WCFpLRpENk699
zb6VjU@XfO-2lz`C+B1MAh`&h9DoGtVqh*k$IH_~jvI*sR%w`or&J0V~=_*dAMf_JR
zwrAr4a${(dG=|7Srq`mxD^gf4vrUPPMktI+#6-}&{VXpLr0CB}oT4-<sT|1J=J8^a
z;~8A$<RL-w+P6m1r!yvw0BOvre0F3M02iI3{Zsa5nMgTl@B-7Qpw!K9Sv~Gp^wMC3
z_fYw|CVRX=vZ=nnhe!}y^G~=n$A#dG@h)%);>a}=5uug{8=Uc07(*vwiiJD1#s(1y
zW`pJ<iHe)yud#To<SlJ^ye-SF2arNMz`005{>!0RcNmE+48`uQL%j6~KKSDg=bn;2
zI?WPIAgO#v9jnL>TqMvmgz9BYvFF$OtBVezb4AcYF2y&>MH6FU3aXdU7-PFJI2SE@
zpshGmu+5{_o02<qj*CrF%I)+jayWczJk4N~BwwR!Jbp;wAAWEgSP8N2h70FUj>S=!
zWa?RTZ{BAcyFK^!E^|h{xoeszsZUMApok+Gp;>7UmS}s_V=l>eB%`out3b8Yr7+f|
z=mx#aAcL5Qin({k)be9OJ0?#O>VPgQKv4^#OAQgFmJk@Tz-FoKjFK|6Lrus<(gO8^
z29>fXj;oZ`V7F6tQK7~}l-go;-`#tI**QYSX~Zez8g=W)`L^z=@f$S`dHoer%BXOt
zDtskCUI|t7G8@RS2J)&M5cB+?3nWS|F)(fc&QjYMCS_>HN-x3|tPY9sA1)3xOq8<*
zj7fX!O!qb|DAyLVQ_pWx<*5mdI`Ea^z$!>7*q~Nt&d*R(@^9%qqH=gR=+J)yy9P{B
zyB@r?7CXF2%4gUFb@-!vNN=lYzK8?5ZVCI58uqW15PmIeP%pLV6zSpo+8)HOE0VSe
z>AHrD(rZwJ5Cv%~)mxAYcw1CxoBprW7%0I}HWNZ2vZ+uPo-XQ*&D=&EXT17`^@LHy
znc7P?is5gB67^CW%$eQ`H+JLSR3t2_+mY3R`VF<?O{l;Tf*w23biqzcd?SY_;cKdZ
zxztIE23Tq^;^-y<)<huI%WMd74dKLS*+~Vf&9alGWhc~XlTd*o1U+`5>5N-ic4D-w
zklGeps0tryz}S}>J#=$0p>=h-a&=MA!fYJ~b53(x^~lqOsU1dGbER8>_g3hnm)Q`{
zYh7|{#CBU@Ym1P#YPxbuO?ewBAcTm=PBfhn3nnA<1+V^w4gzmr#=ej?^{TAn8-eQ^
z0a-7zL0r@zepAi#27F77?_1gJfWQcHX#n}H0Q9W@sh8P6E^8paZ2@`5LEf3Icc=FJ
zooM||Akxchi0*2L?kX$}x?HcxPG`D6fBcSaQ&!OIn+tx;RU3(@@9K-NMylo4f=**D
z^=p%9V?yw2k+(6{ebZoXxUS#u-G=x0X7_1ypzoU3;SR*S4toi{x-p=vt{dgHKEBi=
zB<m$}K)m9x>=EZm&B?A*46Jiy>Tj&GVZ5p*^bDjeb+npJ&w2rZn#<|{ZM8Ot*R?E{
z(YGd9+?19{^hV45bTl_QR$HwN>rE{e+=6w|X3~iYbD{&8=rC=yHkgyz+`R?ntu(16
zwGtEghl?s&->QCitK&7-+0fqBXF;E(QX*o$$0dDzgFL<~wuekMa)<O$Wv4CKp&ai+
z83$^mop;cN);$9@WEn7v?}n;VTn*KsE}=EcyR7FKt<?#l3g9&ZXz_%onPgu}OI=Hl
z_0rC(K(qa36}+1v`vLuyC7)`d8;Pn}-gVj6Vmg{Cdwa-dq;NMhL&O52_mKKDWqe2l
zBK}ihA;jgdJJWVa<qeFjX*}1<qR_mikO7~jgr&Yqeynn+h}DFuLx8xH0U~OP5c*#I
zkZrUNBQ+-QX@96ZEZIueC6^f2*tW%!gawqg4R1A~FdjXERN*1fV$3$mH$@%JWp%b|
z8Gk~ikR<|L%LsHNVh!7g8is1j;rYZcRASOLx-Llyi&ApEPdUwr3J){BC1mND3Ihk!
zdWfpxkFN!>ZIoRz7?sP~H_D)~siNoBVjS>qEvHsTM0MpG#?V`MyXNR-{?@#mdwy%Q
z(6e`C=rC6E0IIGc<Dl!x**Wt!3fMLjleT0<UlfS3#lN-fZgrGZSBYU<zJ<5zg2K$-
zy1?KgDs0PyZklmO9hgjjd3aV=p>are<?J%V>87s|tGEnQ32B=`w{1_*vBlR7bRZ>u
zo43%V`G=NKPX6O^whwu@dPrTh<zG<pmqwSGk=nzJB!=<nZ;Lwep=u*`2)&7%ZGlA9
znzj3j$^Ej3rJ0jRw1+TB2SeX)8_P7O`0BVN9C4M2ply*!Rhc#Xi^+XMx}xVR;*yAU
z5Hl1Kf-O-|8We)Z;Q%a3o_@E4$FIb5?`D7#x>H%(!kwx-Z~PaO{D#o_mOon<*1Ld%
zuy20+@w?8uAfx?(7%&bi;31Gj#L@mx){Lq$AacxUUZ4eWkS>EOl`L<DLYN{|jlK+;
z5^HHaE8-$#jVeTj`d_X6u0I|7eDho92)XbZMK$T9L={i&hf3W@l+q5iPb~Vcbx1oh
z=Cd}GyP=e-$rlp?$EnN%OolKum7>&Xa^ytxtK;bWtC=tBnX%KlJvT~f!byoLoZJtU
zx{)ZYy1nH`H)3$pcI5oT+EDI>QmQInP24$BW!7R+gu$sCrB0J1r_Fx>Bwc@^^M##b
z9rbeia}?HEASG%G<bJ5sjYMhH{cXQY`N}(0c%|8SE6Uwa%GFvB(=A7;%&ts^Fglf@
z)M;|${Qj%s==|#%(o$`@=M%ew^qxX`S0Qs>S+<%9&dDhB1~pG$WvVZ*lA%^VQfh=p
z*nUianNJKf39>gti`xBAZK2j$)hiOe>=z+T^bD7$)z>7-hh+bf*gF4yh_zXF8LdlE
zy-$(7Q$_X|<k6CzibY<Q!3BN8uI^O_l~)~DcJ~N@*xx!3hB^?&*UM~5AJmjSFvdDc
zMTLUeUGON89<C*(MtKKZ&X`dfC*d)rWBOVwHEy$1#kwcnjXB^i#~533I7#~8SnM#~
zY6nGx+G;A>1t+2J%%LcW*I^dqvmN<PpeW<-_oet5{e-eKdHs4vyzi%-cqKT<OLZkq
z%YtAO$5bGk6#NJ*+H~-Qsdw_T7Ww;o5=);G-px@;PCrUh%ubUmGxX#Bdz?REa@+=5
zXW-glLSBs{2XPe3Y?I7Tv56v#xe)SR)07AX(~%Qs-2ZUJyJm2`tGyFP3LbT~Y+VA|
zyC@XJa6NW6DS7>9#?I^TUZq*ojv`I5t<t7_s%|q_j&|W2Ihbk7Ae?3B>^V-!7k$s!
zS;h{n^S6T3yQ^xh-ic0k%3aN7l{qC0^3ijd_XB{cn;07guOsfpUJ#`&JE6zzML}UX
zGS5{<6MN6p^X#w5s?^>a$=UN!awrt%vz|$(@sY#6{Eo*iYE5-MtdVm$BnsU-9_bk}
zF;M1{6T?A&Cg$-MFq3#d!;Zrai*y_vy5ViRXp<+eQxF+1(iJ$gcsH{+E1rU!yp%}3
ztAkM%XA54sP)ZZ}K47hIVJiIO7H4js(*I1)pIE>xrTn?39zSk?GLzF|$%VvLp%8MB
z6pW~3Bt@fthHTVFb?H#_&y;U!;B74c(I%Chr`#^oTh@ujgF`T0Ludl0D5{gb9C|(|
zdJYPdL*ykPhP>vT%~4SX(MO|GI`{=67p63-L5|lrfJwgxNWH<p=VwWJN2h0KB61{{
zUoym-e!^#{*HazVLH|8{|EJ0I-Q{=W(7kd=&Krf`6q6Uomq8vxB}_~7%)SsKTtvYd
z&-T#sGKOS~9v)hNj9IpU8Ec<b6GiBr-W=wukNCCd?UJ|DK}{l@pMy+at|qz$DLN<l
z+yz<%Yr?w+;>a{w9b&tpr$aq2gOW^Y1QN(&Qi?tG{9ulnypx|#(`?GHPKz~;=m`U0
z(3G683hkitKkWbgZ~uFN&aYRq3*K`X$e7{;!gT@N@}FbmonQZOQFVh*#(Ch(#MsRv
zBltNW3Xwp)D~Gz?R&`diwV4-NI}n%Z(g-27$}N2K*tElqE@iSQh<X56g<6Dl!uhR#
zAvqh6ptco{Z^kpjiGV~J+^{A=nmTkeHie8~HXfn@Zd4ssMUGQoT|EV~^%1ry=#kIh
zfbJ(39KDEV7@c2KUI`;EFS$F?gK*bb5|rTcO!$sGDVydWgHPW6@4+1J_xC?t{9F1{
n`v3p;@4r#U)Kk1VgUl_Sm(TI6T#kJZRKO<~8GIWunw@_D6ekFg
--- a/src/typval.c
+++ b/src/typval.c
@@ -2090,7 +2090,19 @@ eval_string(char_u **arg, typval_T *rett
 	    // to 9 characters (6 for the char and 3 for a modifier):
 	    // reserve space for 5 extra.
 	    if (*p == '<')
+	    {
+		int		modifiers = 0;
+		int		flags = FSK_KEYCODE | FSK_IN_STRING;
+
 		extra += 5;
+
+		// Skip to the '>' to avoid using '{' inside for string
+		// interpolation.
+		if (p[1] != '*')
+		    flags |= FSK_SIMPLIFY;
+		if (find_special_key(&p, &modifiers, flags, NULL) != 0)
+		    --p;  // leave "p" on the ">"
+	    }
 	}
 	else if (interpolate && (*p == '{' || *p == '}'))
 	{
--- a/src/version.c
+++ b/src/version.c
@@ -736,6 +736,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    104,
+/**/
     103,
 /**/
     102,