mirror of
https://github.com/vim/vim.git
synced 2025-09-24 03:44:06 -04:00
patch 8.2.3595: check for signed overflow might not work everywhere
Problem: Check for signed overflow might not work everywhere. Solution: Limit to 32 bit int. (closes #9043, closes #9067)
This commit is contained in:
@@ -1001,6 +1001,8 @@ ins_typebuf(
|
||||
}
|
||||
else
|
||||
{
|
||||
int extra;
|
||||
|
||||
/*
|
||||
* Need to allocate a new buffer.
|
||||
* In typebuf.tb_buf there must always be room for 3 * (MAXMAPLEN + 4)
|
||||
@@ -1008,13 +1010,15 @@ ins_typebuf(
|
||||
* often.
|
||||
*/
|
||||
newoff = MAXMAPLEN + 4;
|
||||
newlen = typebuf.tb_len + addlen + newoff + 4 * (MAXMAPLEN + 4);
|
||||
if (newlen < 0) // string is getting too long
|
||||
extra = addlen + newoff + 4 * (MAXMAPLEN + 4);
|
||||
if (typebuf.tb_len > 2147483647 - extra)
|
||||
{
|
||||
// string is getting too long for a 32 bit int
|
||||
emsg(_(e_toocompl)); // also calls flush_buffers
|
||||
setcursor();
|
||||
return FAIL;
|
||||
}
|
||||
newlen = typebuf.tb_len + extra;
|
||||
s1 = alloc(newlen);
|
||||
if (s1 == NULL) // out of memory
|
||||
return FAIL;
|
||||
|
Reference in New Issue
Block a user