aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-23 03:43:49 -04:00
Code Activity

patch 8.0.0537: illegal memory access with :z and large count

Browse Source 
Problem:    Illegal memory access with :z and large count.
Solution:   Check for number overflow, using long instead of int. (Dominique
            Pelle, closes #1612)
This commit is contained in:
Bram Moolenaar
2017-04-02 15:45:17 +02:00
parent 69f40be645
commit fa0ad0bb0b
5 changed files with 92 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/ex_cmds.c
View File

@@ -4564,7 +4564,7 @@ ex_change(exarg_T *eap)
ex_z(exarg_T *eap)
{
char_u *x;
int bigness;
long bigness;
char_u *kind;
int minus = 0;
linenr_T start, end, curs, i;
@@ -4601,7 +4601,12 @@ ex_z(exarg_T *eap)
}
else
{
bigness = atoi((char *)x);
bigness = atol((char *)x);
/* bigness could be < 0 if atol(x) overflows. */
if (bigness > 2 * curbuf->b_ml.ml_line_count || bigness < 0)
bigness = 2 * curbuf->b_ml.ml_line_count;
p_window = bigness;
if (*kind == '=')
bigness += 2;