aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-23 03:43:49 -04:00
Code Activity

patch 9.0.2109: [security]: overflow in nv_z_get_count

Browse Source 
Problem:  [security]: overflow in nv_z_get_count
Solution: break out, if count is too large

When getting the count for a normal z command, it may overflow for large
counts given. So verify, that we can safely store the result in a long.

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt
2023-11-14 21:02:30 +01:00
parent ac63787734
commit 58f9befca1
3 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/normal.c
View File

@@ -2562,7 +2562,14 @@ nv_z_get_count(cmdarg_T *cap, int *nchar_arg)
if (nchar == K_DEL || nchar == K_KDEL)
n /= 10;
else if (VIM_ISDIGIT(nchar))
{
if (n > LONG_MAX / 10)
{
clearopbeep(cap->oap);
break;
}
n = n * 10 + (nchar - '0');
}
else if (nchar == CAR)
{
#ifdef FEAT_GUI