aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-24 03:44:06 -04:00
Code Activity

patch 8.2.5046: vim_regsub() can overwrite the destination

Browse Source 
Problem:    vim_regsub() can overwrite the destination.
Solution:   Pass the destination length, give an error when it doesn't fit.
This commit is contained in:
Bram Moolenaar
2022-05-30 20:58:55 +01:00
parent 10db31f949
commit 4aaf3e7f4d
6 changed files with 111 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/ex_cmds.c
View File

@@ -4419,7 +4419,9 @@ ex_substitute(exarg_T *eap)
// get length of substitution part
sublen = vim_regsub_multi(&regmatch,
sub_firstlnum - regmatch.startpos[0].lnum,
sub, sub_firstline, FALSE, magic_isset(), TRUE);
sub, sub_firstline, 0,
REGSUB_BACKSLASH
| (magic_isset() ? REGSUB_MAGIC : 0));
#ifdef FEAT_EVAL
--textlock;
@@ -4528,7 +4530,9 @@ ex_substitute(exarg_T *eap)
#endif
(void)vim_regsub_multi(&regmatch,
sub_firstlnum - regmatch.startpos[0].lnum,
sub, new_end, TRUE, magic_isset(), TRUE);
sub, new_end, sublen,
REGSUB_COPY | REGSUB_BACKSLASH
| (magic_isset() ? REGSUB_MAGIC : 0));
#ifdef FEAT_EVAL
--textlock;
#endif