mirror of
https://github.com/neovim/neovim.git
synced 2025-09-28 22:18:33 +00:00
vim-patch:9.0.2109: [security]: overflow in nv_z_get_count
Problem: [security]: overflow in nv_z_get_count
Solution: break out, if count is too large
When getting the count for a normal z command, it may overflow for large
counts given. So verify, that we can safely store the result in a long.
58f9befca1
Co-authored-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
@@ -2695,6 +2695,10 @@ static bool nv_z_get_count(cmdarg_T *cap, int *nchar_arg)
|
||||
if (nchar == K_DEL || nchar == K_KDEL) {
|
||||
n /= 10;
|
||||
} else if (ascii_isdigit(nchar)) {
|
||||
if (n > INT_MAX / 10) {
|
||||
clearopbeep(cap->oap);
|
||||
break;
|
||||
}
|
||||
n = n * 10 + (nchar - '0');
|
||||
} else if (nchar == CAR) {
|
||||
win_setheight(n);
|
||||
|
Reference in New Issue
Block a user