aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-23 03:43:49 -04:00
Code Activity

patch 8.2.5046: vim_regsub() can overwrite the destination

Browse Source 
Problem:    vim_regsub() can overwrite the destination.
Solution:   Pass the destination length, give an error when it doesn't fit.
This commit is contained in:
Bram Moolenaar
2022-05-30 20:58:55 +01:00
parent 10db31f949
commit 4aaf3e7f4d
6 changed files with 111 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/eval.c
View File

@@ -6905,7 +6905,7 @@ do_string_sub(
* - The substituted text.
* - The text after the match.
*/
sublen = vim_regsub(&regmatch, sub, expr, tail, FALSE, TRUE, FALSE);
sublen = vim_regsub(&regmatch, sub, expr, tail, 0, REGSUB_MAGIC);
if (ga_grow(&ga, (int)((end - tail) + sublen -
(regmatch.endp[0] - regmatch.startp[0]))) == FAIL)
{
@@ -6917,8 +6917,9 @@ do_string_sub(
i = (int)(regmatch.startp[0] - tail);
mch_memmove((char_u *)ga.ga_data + ga.ga_len, tail, (size_t)i);
// add the substituted text
(void)vim_regsub(&regmatch, sub, expr, (char_u *)ga.ga_data
+ ga.ga_len + i, TRUE, TRUE, FALSE);
(void)vim_regsub(&regmatch, sub, expr,
(char_u *)ga.ga_data + ga.ga_len + i, sublen,
REGSUB_COPY | REGSUB_MAGIC);
ga.ga_len += i + sublen - 1;
tail = regmatch.endp[0];
if (*tail == NUL)