mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-06 03:18:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #32895 from zeertzjq/vim-8.2.4963

Browse Source 
vim-patch: buffer overflow when expanding long file name
This commit is contained in:
zeertzjq
2025-03-15 08:38:07 +08:00
committed by GitHub
parent f1422a313f b0b61c42b3
commit e7627db35f
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/nvim/path.c
View File

@@ -627,7 +627,8 @@ static size_t do_path_expand(garray_T *gap, const char *path, size_t wildoff, in
// Make room for file name. When doing encoding conversion the actual // Make room for file name. When doing encoding conversion the actual
// length may be quite a bit longer, thus use the maximum possible length. // length may be quite a bit longer, thus use the maximum possible length.
char *buf = xmalloc(MAXPATHL); const size_t buflen = strlen(path) + MAXPATHL;
char *buf = xmalloc(buflen);
// Find the first part in the path name that contains a wildcard. // Find the first part in the path name that contains a wildcard.
// When EW_ICASE is set every letter is considered to be a wildcard. // When EW_ICASE is set every letter is considered to be a wildcard.
@@ -739,20 +740,19 @@ static size_t do_path_expand(garray_T *gap, const char *path, size_t wildoff, in
&& ((regmatch.regprog != NULL && vim_regexec(&regmatch, name, 0)) && ((regmatch.regprog != NULL && vim_regexec(&regmatch, name, 0))
|| ((flags & EW_NOTWILD) || ((flags & EW_NOTWILD)
&& path_fnamencmp(path + (s - buf), name, (size_t)(e - s)) == 0))) { && path_fnamencmp(path + (s - buf), name, (size_t)(e - s)) == 0))) {
STRCPY(s, name); xstrlcpy(s, name, buflen - (size_t)(s - buf));
len = strlen(buf); len = strlen(buf);
if (starstar && stardepth < 100) { if (starstar && stardepth < 100) {
// For "**" in the pattern first go deeper in the tree to // For "**" in the pattern first go deeper in the tree to
// find matches. // find matches.
STRCPY(buf + len, "/**"); // NOLINT vim_snprintf(buf + len, buflen - len, "/**%s", path_end); // NOLINT
STRCPY(buf + len + 3, path_end);
stardepth++; stardepth++;
do_path_expand(gap, buf, len + 1, flags, true); do_path_expand(gap, buf, len + 1, flags, true);
stardepth--; stardepth--;
} }
STRCPY(buf + len, path_end); vim_snprintf(buf + len, buflen - len, "%s", path_end);
if (path_has_exp_wildcard(path_end)) { // handle more wildcards if (path_has_exp_wildcard(path_end)) { // handle more wildcards
// need to expand another component of the path // need to expand another component of the path
// remove backslashes for the remaining components only // remove backslashes for the remaining components only