diff options
| author | Bram Moolenaar <Bram@vim.org> | 2016-01-05 20:46:16 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2016-01-05 20:46:16 +0100 |
| commit | 04bff88df6211f64731bf8f5afa088e94496db16 (patch) | |
| tree | 01637b64a54694cc1fc8296fc938f694dd07ee8d | |
| parent | af8af8bfac5792fa64efbc524032d568cc7754f7 (diff) | |
| download | vim-git-04bff88df6211f64731bf8f5afa088e94496db16.tar.gz | |
patch 7.4.1052v7.4.1052
Problem: Illegal memory access with weird syntax command. (Dominique Pelle)
Solution: Check for column past end of line.
| -rw-r--r-- | src/syntax.c | 7 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 7 insertions, 2 deletions
diff --git a/src/syntax.c b/src/syntax.c index ae3a88a61..937fbf186 100644 --- a/src/syntax.c +++ b/src/syntax.c @@ -3022,6 +3022,8 @@ find_endpos(idx, startpos, m_endpos, hl_endpos, flagsp, end_endpos, if (r && regmatch.startpos[0].col <= best_regmatch.startpos[0].col) { + int line_len; + /* Add offset to skip pattern match */ syn_add_end_off(&pos, ®match, spp_skip, SPO_ME_OFF, 1); @@ -3031,6 +3033,7 @@ find_endpos(idx, startpos, m_endpos, hl_endpos, flagsp, end_endpos, break; line = ml_get_buf(syn_buf, startpos->lnum, FALSE); + line_len = (int)STRLEN(line); /* take care of an empty match or negative offset */ if (pos.col <= matchcol) @@ -3040,12 +3043,12 @@ find_endpos(idx, startpos, m_endpos, hl_endpos, flagsp, end_endpos, else /* Be careful not to jump over the NUL at the end-of-line */ for (matchcol = regmatch.endpos[0].col; - line[matchcol] != NUL && matchcol < pos.col; + matchcol < line_len && matchcol < pos.col; ++matchcol) ; /* if the skip pattern includes end-of-line, break here */ - if (line[matchcol] == NUL) + if (matchcol >= line_len) break; continue; /* start with first end pattern again */ diff --git a/src/version.c b/src/version.c index 402fd0ab0..c4771baf6 100644 --- a/src/version.c +++ b/src/version.c @@ -742,6 +742,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 1052, +/**/ 1051, /**/ 1050, |