mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-20 10:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:7.4.736 #2998

Browse Source 
Problem:    Invalid memory access.
Solution:   Avoid going over the end of a NUL terminated string. (Dominique
            Pelle)

https://github.com/vim/vim/commit/v7-4-736
This commit is contained in:
cztchoice
2015-07-12 08:09:24 +08:00
committed by Justin M. Keyes
parent 366aa8c196
commit c80ebfff82
2 changed files with 46 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/nvim/regexp.c
View File

@@ -1104,7 +1104,7 @@ static int get_coll_element(char_u **pp)
int l = 1;
char_u *p = *pp;
if (p[1] == '.') {
if (p[0] != NUL && p[1] == '.') {
if (has_mbyte)
l = (*mb_ptr2len)(p + 2);
if (p[l + 2] == '.' && p[l + 3] == ']') {
@@ -1156,8 +1156,9 @@ static char_u *skip_anyof(char_u *p)
else if (*p == '[') {
if (get_char_class(&p) == CLASS_NONE
&& get_equi_class(&p) == 0
&& get_coll_element(&p) == 0)
++p; /* It was not a class name */
&& get_coll_element(&p) == 0
&& *p != NUL)
++p; /* It is not a class name and not NUL */
} else
++p;
}
@@ -2848,7 +2849,7 @@ static int peekchr(void)
/*
* META contains everything that may be magic sometimes,
* except ^ and $ ("\^" and "\$" are only magic after
* "\v"). We now fetch the next character and toggle its
* "\V"). We now fetch the next character and toggle its
* magicness. Therefore, \ is so meta-magic that it is
* not in META.
*/