diff options
| author | Bram Moolenaar <Bram@vim.org> | 2019-02-28 06:25:00 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2019-02-28 06:25:00 +0100 |
| commit | ab350f89f9646e07aefe16a32ba3ddb847496b4a (patch) | |
| tree | 31e46202b9d76c49c1f0634e4ae68c81cd5c1991 | |
| parent | c69efcb42fd98d9fcd5f7e01e3b029b0b777df0f (diff) | |
| download | vim-git-ab350f89f9646e07aefe16a32ba3ddb847496b4a.tar.gz | |
patch 8.1.0985: crash with large number in regexpv8.1.0985
Problem: Crash with large number in regexp. (Kuang-che Wu)
Solution: Check for long becoming negative int. (closes #)
| -rw-r--r-- | src/regexp.c | 4 | ||||
| -rw-r--r-- | src/testdir/test_search.vim | 25 | ||||
| -rw-r--r-- | src/version.c | 2 |
3 files changed, 28 insertions, 3 deletions
diff --git a/src/regexp.c b/src/regexp.c index 5c06ada1b..d7c577077 100644 --- a/src/regexp.c +++ b/src/regexp.c @@ -2228,7 +2228,7 @@ regatom(int *flagp) default: i = -1; break; } - if (i < 0) + if (i < 0 || i > INT_MAX) EMSG2_RET_NULL( _("E678: Invalid character after %s%%[dxouU]"), reg_magic == MAGIC_ALL); @@ -3293,7 +3293,7 @@ coll_get_char(void) case 'u': nr = gethexchrs(4); break; case 'U': nr = gethexchrs(8); break; } - if (nr < 0) + if (nr < 0 || nr > INT_MAX) { /* If getting the number fails be backwards compatible: the character * is a backslash. */ diff --git a/src/testdir/test_search.vim b/src/testdir/test_search.vim index 5cf70d4d8..d32369d5a 100644 --- a/src/testdir/test_search.vim +++ b/src/testdir/test_search.vim @@ -1212,13 +1212,36 @@ func Test_search_Ctrl_L_combining() call Incsearch_cleanup() endfunc -func Test_large_hex_chars() +func Test_large_hex_chars1() " This used to cause a crash, the character becomes an NFA state. try /\%Ufffffc23 catch call assert_match('E678:', v:exception) endtry + try + set re=1 + /\%Ufffffc23 + catch + call assert_match('E678:', v:exception) + endtry + set re& +endfunc + +func Test_large_hex_chars2() + " This used to cause a crash, the character becomes an NFA state. + try + /[\Ufffffc1f] + catch + call assert_match('E486:', v:exception) + endtry + try + set re=1 + /[\Ufffffc1f] + catch + call assert_match('E486:', v:exception) + endtry + set re& endfunc func Test_one_error_msg() diff --git a/src/version.c b/src/version.c index 74850a0b3..9b87302cc 100644 --- a/src/version.c +++ b/src/version.c @@ -780,6 +780,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 985, +/**/ 984, /**/ 983, |