mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2026-04-24 08:15:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.1.0985: crash with large number in regexp

Browse Source 
Problem:    Crash with large number in regexp. (Kuang-che Wu)
Solution:   Check for long becoming negative int. (closes #)
ab350f89f9
This commit is contained in:
Justin M. Keyes
2019-02-28 01:26:40 +01:00
parent 533d4a36ec
commit a66b1d4615
2 changed files with 46 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
src/nvim/regexp.c
View File

@@ -2098,18 +2098,20 @@ static char_u *regatom(int *flagp)
default: i = -1; break;
}
if (i < 0)
EMSG2_RET_NULL(
_("E678: Invalid character after %s%%[dxouU]"),
reg_magic == MAGIC_ALL);
if (use_multibytecode(i))
if (i < 0 || i > INT_MAX) {
EMSG2_RET_NULL(_("E678: Invalid character after %s%%[dxouU]"),
reg_magic == MAGIC_ALL);
}
if (use_multibytecode(i)) {
ret = regnode(MULTIBYTECODE);
else
} else {
ret = regnode(EXACTLY);
if (i == 0)
}
if (i == 0) {
regc(0x0a);
else
} else {
regmbc(i);
}
regc(NUL);
*flagp |= HASWIDTH;
break;
@@ -3063,10 +3065,10 @@ static int coll_get_char(void)
case 'u': nr = gethexchrs(4); break;
case 'U': nr = gethexchrs(8); break;
}
if (nr < 0) {
/* If getting the number fails be backwards compatible: the character
* is a backslash. */
--regparse;
if (nr < 0 || nr > INT_MAX) {
// If getting the number fails be backwards compatible: the character
// is a backslash.
regparse--;
nr = '\\';
}
return nr;

32
src/nvim/testdir/test_search.vim
View File

@@ -524,3 +524,35 @@ func Test_search_sentence()
/\%'(
/
endfunc
func Test_large_hex_chars1()
" This used to cause a crash, the character becomes an NFA state.
try
/\%Ufffffc23
catch
call assert_match('E678:', v:exception)
endtry
try
set re=1
/\%Ufffffc23
catch
call assert_match('E678:', v:exception)
endtry
set re&
endfunc
func Test_large_hex_chars2()
" This used to cause a crash, the character becomes an NFA state.
try
/[\Ufffffc1f]
catch
call assert_match('E486:', v:exception)
endtry
try
set re=1
/[\Ufffffc1f]
catch
call assert_match('E486:', v:exception)
endtry
set re&
endfunc