mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-06 11:28:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20870 from neovim/backport-20854-to-release-0.8

Browse Source 
[Backport release-0.8] fix: avoid unsigned overflow in home_replace()
This commit is contained in:
zeertzjq
2022-10-30 07:06:30 +08:00
committed by GitHub
parent 5eab16fa24 06144afb71
commit f70feadb17
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/nvim/os/env.c
View File

@@ -1119,10 +1119,16 @@ size_t home_replace(const buf_T *const buf, const char *src, char *const dst, si
len = envlen; len = envlen;
} }
if (dstlen == 0) {
break; // Avoid overflowing below.
}
// if (!one) skip to separator: space or comma. // if (!one) skip to separator: space or comma.
while (*src && (one || (*src != ',' && *src != ' ')) && --dstlen > 0) { while (*src && (one || (*src != ',' && *src != ' ')) && --dstlen > 0) {
*dst_p++ = *src++; *dst_p++ = *src++;
} }
if (dstlen == 0) {
break; // Avoid overflowing below.
}
// Skip separator. // Skip separator.
while ((*src == ' ' || *src == ',') && --dstlen > 0) { while ((*src == ' ' || *src == ',') && --dstlen > 0) {
*dst_p++ = *src++; *dst_p++ = *src++;

6
test/functional/editor/tabpage_spec.lua
View File

@@ -144,4 +144,10 @@ describe('tabpage', function()
command(' silent :keepalt :: ::: silent! -2 tabmove') command(' silent :keepalt :: ::: silent! -2 tabmove')
eq(1, funcs.nvim_tabpage_get_number(0)) eq(1, funcs.nvim_tabpage_get_number(0))
end) end)
it(':tabs does not overflow IObuff with long path with comma #20850', function()
meths.buf_set_name(0, ('x'):rep(1024) .. ',' .. ('x'):rep(1024))
command('tabs')
assert_alive()
end)
end) end)