From ee717447dd7e7989b8d9026577a39a2ec2a0f703 Mon Sep 17 00:00:00 2001 From: Jan Edmund Lazo Date: Wed, 24 Dec 2025 00:50:29 -0500 Subject: [PATCH] vim-patch:9.1.1491: missing out-of-memory checks in cmdexpand.c Problem: missing out-of-memory checks in cmdexpand.c Solution: add out-of-memory checks for expand_files_and_dirs(), ExpandUserDefined() and ExpandUserList() (John Marriott) closes: vim/vim#17570 https://github.com/vim/vim/commit/3b03b435a29391ded301fa2f377141db3c8093b7 Co-authored-by: John Marriott --- src/nvim/cmdexpand.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/nvim/cmdexpand.c b/src/nvim/cmdexpand.c index af56fd4ffe..93f19a35be 100644 --- a/src/nvim/cmdexpand.c +++ b/src/nvim/cmdexpand.c @@ -3472,12 +3472,14 @@ static int ExpandUserDefined(const char *const pat, expand_T *xp, regmatch_T *re *e = keep; if (match) { + char *p = xmemdupz(s, (size_t)(e - s)); + if (!fuzzy) { - GA_APPEND(char *, &ga, xmemdupz(s, (size_t)(e - s))); + GA_APPEND(char *, &ga, p); } else { GA_APPEND(fuzmatch_str_T, &ga, ((fuzmatch_str_T){ .idx = ga.ga_len, - .str = xmemdupz(s, (size_t)(e - s)), + .str = p, .score = score, })); } @@ -3521,8 +3523,9 @@ static int ExpandUserList(expand_T *xp, char ***matches, int *numMatches) || TV_LIST_ITEM_TV(li)->vval.v_string == NULL) { continue; // Skip non-string items and empty strings. } + char *p = xstrdup(TV_LIST_ITEM_TV(li)->vval.v_string); - GA_APPEND(char *, &ga, xstrdup(TV_LIST_ITEM_TV(li)->vval.v_string)); + GA_APPEND(char *, &ga, p); }); tv_list_unref(retlist);