mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2026-04-19 22:10:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.1.2133: Another case of buffer overflow with 'helpfile' (#37746)

Browse Source 
Problem:  Another case of buffer overflow with 'helpfile'.
Solution: Leave room for "tags" in the buffer (zeertzjq).

closes: vim/vim#19340

21d591fb12
This commit is contained in:
zeertzjq
2026-02-06 18:29:24 +08:00
committed by GitHub
parent db133879b2
commit 15061d322d
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/nvim/tag.c
View File

@@ -2500,7 +2500,7 @@ int get_tagfname(tagname_T *tnp, int first, char *buf)
return FAIL; return FAIL;
} }
tnp->tn_hf_idx++; tnp->tn_hf_idx++;
xstrlcpy(buf, p_hf, MAXPATHL); xstrlcpy(buf, p_hf, MAXPATHL - STRLEN_LITERAL("tags"));
STRCPY(path_tail(buf), "tags"); STRCPY(path_tail(buf), "tags");
#ifdef BACKSLASH_IN_FILENAME #ifdef BACKSLASH_IN_FILENAME
slash_adjust(buf); slash_adjust(buf);

5
test/old/testdir/test_help.vim
View File

@@ -302,6 +302,11 @@ func Test_helpfile_overflow()
let &helpfile = repeat('A', 5000) let &helpfile = repeat('A', 5000)
help help
helpclose helpclose
for i in range(4089, 4096)
let &helpfile = repeat('A', i) .. '/A'
help
helpclose
endfor
let &helpfile = _helpfile let &helpfile = _helpfile
endfunc endfunc