aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-29 04:34:16 -04:00
Code Activity

patch 9.0.1532: crash when expanding "~" in substitute causes very long text

Browse Source 
Problem:    Crash when expanding "~" in substitute causes very long text.
Solution:   Limit the text length to MAXCOL.
This commit is contained in:
Bram Moolenaar
2023-05-09 21:15:30 +01:00
parent d1ae8366af
commit ab9a2d884b
3 changed files with 35 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
src/regexp.c
View File

@@ -1767,10 +1767,7 @@ do_Lower(int *d, int c)
regtilde(char_u *source, int magic)
{
char_u *newsub = source;
char_u *tmpsub;
char_u *p;
int len;
int prevlen;
for (p = newsub; *p; ++p)
{
@@ -1779,24 +1776,35 @@ regtilde(char_u *source, int magic)
if (reg_prev_sub != NULL)
{
// length = len(newsub) - 1 + len(prev_sub) + 1
prevlen = (int)STRLEN(reg_prev_sub);
tmpsub = alloc(STRLEN(newsub) + prevlen);
// Avoid making the text longer than MAXCOL, it will cause
// trouble at some point.
size_t prevsublen = STRLEN(reg_prev_sub);
size_t newsublen = STRLEN(newsub);
if (prevsublen > MAXCOL || newsublen > MAXCOL
|| newsublen + prevsublen > MAXCOL)
{
emsg(_(e_resulting_text_too_long));
break;
}
char_u *tmpsub = alloc(newsublen + prevsublen);
if (tmpsub != NULL)
{
// copy prefix
len = (int)(p - newsub); // not including ~
mch_memmove(tmpsub, newsub, (size_t)len);
size_t prefixlen = p - newsub; // not including ~
mch_memmove(tmpsub, newsub, prefixlen);
// interpret tilde
mch_memmove(tmpsub + len, reg_prev_sub, (size_t)prevlen);
mch_memmove(tmpsub + prefixlen, reg_prev_sub,
prevsublen);
// copy postfix
if (!magic)
++p; // back off backslash
STRCPY(tmpsub + len + prevlen, p + 1);
STRCPY(tmpsub + prefixlen + prevsublen, p + 1);
if (newsub != source) // already allocated newsub
if (newsub != source) // allocated newsub before
vim_free(newsub);
newsub = tmpsub;
p = newsub + len + prevlen;
p = newsub + prefixlen + prevsublen;
}
}
else if (magic)