thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 9.0.1848: [security] buffer-overflow in vim_regsub_both()

Browse Source 
Problem:  buffer-overflow in vim_regsub_both()
Solution: Check remaining space

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt
2023-09-02 21:15:52 +02:00
parent 889f6af371
commit ced2c7394a
5 changed files with 27 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/ex_cmds.c
View File

@@ -4651,6 +4651,9 @@ ex_substitute(exarg_T *eap)
mch_memmove(new_end, sub_firstline + copycol, (size_t)copy_len);
new_end += copy_len;
if (new_start_len - copy_len < sublen)
sublen = new_start_len - copy_len - 1;
#ifdef FEAT_EVAL
++textlock;
#endif