thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 8.0.0530: buffer overflow when 'columns' is very big

Browse Source 
Problem:    Buffer overflow when 'columns' is very big. (Nikolai Pavlov)
Solution:   Correctly compute where to truncate.  Fix translation.
            (closes #1600)
This commit is contained in:
Bram Moolenaar
2017-03-31 22:27:12 +02:00
parent 13489b9c41
commit 658a3a2caf
3 changed files with 47 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
src/edit.c
View File

@@ -4756,7 +4756,6 @@ ins_compl_next(
int in_compl_func) /* called from complete_check() */
{
int num_matches = -1;
int i;
int todo = count;
compl_T *found_compl = NULL;
int found_end = FALSE;
@@ -4948,15 +4947,30 @@ ins_compl_next(
*/
if (compl_shown_match->cp_fname != NULL)
{
STRCPY(IObuff, "match in file ");
i = (vim_strsize(compl_shown_match->cp_fname) + 16) - sc_col;
if (i <= 0)
i = 0;
else
STRCAT(IObuff, "<");
STRCAT(IObuff, compl_shown_match->cp_fname + i);
msg(IObuff);
redraw_cmdline = FALSE; /* don't overwrite! */
char *lead = _("match in file");
int space = sc_col - vim_strsize((char_u *)lead) - 2;
char_u *s;
char_u *e;
if (space > 0)
{
/* We need the tail that fits. With double-byte encoding going
* back from the end is very slow, thus go from the start and keep
* the text that fits in "space" between "s" and "e". */
for (s = e = compl_shown_match->cp_fname; *e != NUL; MB_PTR_ADV(e))
{
space -= ptr2cells(e);
while (space < 0)
{
space += ptr2cells(s);
MB_PTR_ADV(s);
}
}
vim_snprintf((char *)IObuff, IOSIZE, "%s %s%s", lead,
s > compl_shown_match->cp_fname ? "<" : "", s);
msg(IObuff);
redraw_cmdline = FALSE; /* don't overwrite! */
}
}
return num_matches;