mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-10-03 16:36:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.5050: using freed memory when searching for pattern in path

Browse Source 
Problem:    Using freed memory when searching for pattern in path.
Solution:   Make a copy of the line.
409510c588

Cherry-pick Test_def_search() -> Test_macro_search() from patch 8.2.0369
This commit is contained in:
zeertzjq
2022-07-12 16:17:36 +08:00
parent 4aa4675fbf
commit aa373e3abb
2 changed files with 25 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/nvim/search.c
View File

@@ -5303,6 +5303,16 @@ void f_matchfuzzypos(typval_T *argvars, typval_T *rettv, FunPtr fptr)
do_fuzzymatch(argvars, rettv, true); do_fuzzymatch(argvars, rettv, true);
} }
/// Get line "lnum" and copy it into "buf[LSIZE]".
/// The copy is made because the regexp may make the line invalid when using a
/// mark.
static char_u *get_line_and_copy(linenr_T lnum, char_u *buf)
{
char_u *line = ml_get(lnum);
STRLCPY(buf, line, LSIZE);
return buf;
}
/// Find identifiers or defines in included files. /// Find identifiers or defines in included files.
/// If p_ic && (compl_cont_status & CONT_SOL) then ptr must be in lowercase. /// If p_ic && (compl_cont_status & CONT_SOL) then ptr must be in lowercase.
/// ///
@@ -5399,7 +5409,7 @@ void find_pattern_in_path(char_u *ptr, Direction dir, size_t len, bool whole, bo
if (lnum > end_lnum) { // do at least one line if (lnum > end_lnum) { // do at least one line
lnum = end_lnum; lnum = end_lnum;
} }
line = ml_get(lnum); line = get_line_and_copy(lnum, file_line);
for (;;) { for (;;) {
if (incl_regmatch.regprog != NULL if (incl_regmatch.regprog != NULL
@@ -5687,7 +5697,7 @@ search_line:
if (lnum >= end_lnum) { if (lnum >= end_lnum) {
goto exit_matched; goto exit_matched;
} }
line = ml_get(++lnum); line = get_line_and_copy(++lnum, file_line);
} else if (vim_fgets(line = file_line, } else if (vim_fgets(line = file_line,
LSIZE, files[depth].fp)) { LSIZE, files[depth].fp)) {
goto exit_matched; goto exit_matched;
@@ -5879,7 +5889,7 @@ exit_matched:
if (++lnum > end_lnum) { if (++lnum > end_lnum) {
break; break;
} }
line = ml_get(lnum); line = get_line_and_copy(lnum, file_line);
} }
already = NULL; already = NULL;
} }

13
src/nvim/testdir/test_tagjump.vim
View File

@@ -1180,9 +1180,20 @@ func Test_inc_search()
close! close!
endfunc endfunc
" this was using a line from ml_get() freed by the regexp
func Test_isearch_copy_line()
new
norm o
norm 0
0norm o
sil! norm bc0
sil! isearch \%')
bwipe!
endfunc
" Test for :dsearch, :dlist, :djump and :dsplit commands " Test for :dsearch, :dlist, :djump and :dsplit commands
" Test for [d, ]d, [D, ]D, [ CTRL-D, ] CTRL-D and CTRL-W d commands " Test for [d, ]d, [D, ]D, [ CTRL-D, ] CTRL-D and CTRL-W d commands
func Test_def_search() func Test_macro_search()
new new
call setline(1, ['#define FOO 1', '#define FOO 2', '#define FOO 3', call setline(1, ['#define FOO 1', '#define FOO 2', '#define FOO 3',
\ '#define FOO 4', '#define FOO 5']) \ '#define FOO 4', '#define FOO 5'])