49 lines
1.4 KiB
Diff
49 lines
1.4 KiB
Diff
From baefde14550231f6468ac2ed2ed495bc381c0c92 Mon Sep 17 00:00:00 2001
|
||
From: Bram Moolenaar <Bram@vim.org>
|
||
Date: Thu, 7 Jul 2022 19:59:49 +0100
|
||
Subject: [PATCH] patch 9.0.0046: reading past end of completion with duplicate
|
||
match
|
||
|
||
Problem: Reading past end of completion with duplicate match.
|
||
Solution: Check string length
|
||
---
|
||
src/insexpand.c | 3 ++-
|
||
src/testdir/test_ins_complete.vim | 10 ++++++++++
|
||
2 files changed, 12 insertions(+), 1 deletion(-)
|
||
|
||
diff --git a/src/insexpand.c b/src/insexpand.c
|
||
index bf98cee..50e0579 100644
|
||
--- a/src/insexpand.c
|
||
+++ b/src/insexpand.c
|
||
@@ -597,7 +597,8 @@ ins_compl_add(
|
||
{
|
||
if ( !(match->cp_flags & CP_ORIGINAL_TEXT)
|
||
&& STRNCMP(match->cp_str, str, len) == 0
|
||
- && match->cp_str[len] == NUL)
|
||
+ && ((int)STRLEN(match->cp_str) <= len
|
||
+ || match->cp_str[len] == NUL))
|
||
return NOTDONE;
|
||
match = match->cp_next;
|
||
} while (match != NULL && match != compl_first_match);
|
||
diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
|
||
index e48a72c..8f584d3 100644
|
||
--- a/src/testdir/test_ins_complete.vim
|
||
+++ b/src/testdir/test_ins_complete.vim
|
||
@@ -380,3 +380,13 @@ func Test_ins_completeslash()
|
||
set completeslash=
|
||
endfunc
|
||
|
||
+func Test_ins_complete_add()
|
||
+ " this was reading past the end of allocated memory
|
||
+ new
|
||
+ norm o
|
||
+ norm 7o
|
||
+ sil! norm o
|
||
+
|
||
+ bwipe!
|
||
+endfunc
|
||
+
|
||
--
|
||
1.8.3.1
|
||
|