diff options
| author | Bram Moolenaar <Bram@vim.org> | 2019-02-21 22:28:51 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2019-02-21 22:28:51 +0100 |
| commit | 527a2d86fb375fcc7b34e80fc47f4c7126fc12ba (patch) | |
| tree | e2fe29e171da1e3b7d40c654bc348ba7009e1926 | |
| parent | 1417031cfd31dd1af9bab686237cb1c8591e0a37 (diff) | |
| download | vim-git-8.1.0968.tar.gz | |
patch 8.1.0968: crash when using search pattern \%Ufffffc23v8.1.0968
Problem: Crash when using search pattern \%Ufffffc23.
Solution: Limit character to INT_MAX. (closes #4009)
| -rw-r--r-- | src/regexp_nfa.c | 2 | ||||
| -rw-r--r-- | src/testdir/test_search.vim | 9 | ||||
| -rw-r--r-- | src/version.c | 2 |
3 files changed, 12 insertions, 1 deletions
diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c index 333c006f4..ba75834fc 100644 --- a/src/regexp_nfa.c +++ b/src/regexp_nfa.c @@ -1475,7 +1475,7 @@ nfa_regatom(void) default: nr = -1; break; } - if (nr < 0) + if (nr < 0 || nr > INT_MAX) EMSG2_RET_FAIL( _("E678: Invalid character after %s%%[dxouU]"), reg_magic == MAGIC_ALL); diff --git a/src/testdir/test_search.vim b/src/testdir/test_search.vim index 972144aca..4ff2aca5a 100644 --- a/src/testdir/test_search.vim +++ b/src/testdir/test_search.vim @@ -1211,3 +1211,12 @@ func Test_search_Ctrl_L_combining() call assert_equal(bufcontent[1], @/) call Incsearch_cleanup() endfunc + +func Test_large_hex_chars() + " This used to cause a crash, the character becomes an NFA state. + try + /\%Ufffffc23 + catch + call assert_match('E678:', v:exception) + endtry +endfunc diff --git a/src/version.c b/src/version.c index 825c5e54b..13f54e343 100644 --- a/src/version.c +++ b/src/version.c @@ -780,6 +780,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 968, +/**/ 967, /**/ 966, |