diff options
| author | Bram Moolenaar <Bram@vim.org> | 2010-08-13 16:51:26 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2010-08-13 16:51:26 +0200 |
| commit | 35a3423c6ae785bf739319e1ec416b2de1462a8c (patch) | |
| tree | e3349f94a29f56a357978df3bf0ac8a3785a1e4d /src/ex_getln.c | |
| parent | 4a474d36d7c5f40ce326d40d09549e86a7873a98 (diff) | |
| download | vim-git-35a3423c6ae785bf739319e1ec416b2de1462a8c.tar.gz | |
Fix illegal memory access when using expressions in the command line.
Diffstat (limited to 'src/ex_getln.c')
| -rw-r--r-- | src/ex_getln.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/ex_getln.c b/src/ex_getln.c index d2925535e..1cf678543 100644 --- a/src/ex_getln.c +++ b/src/ex_getln.c @@ -2527,7 +2527,10 @@ realloc_cmdbuff(len) ccline.cmdbuff = p; /* keep the old one */ return FAIL; } - mch_memmove(ccline.cmdbuff, p, (size_t)ccline.cmdlen + 1); + /* There isn't always a NUL after the command, but it may need to be + * there, thus copy up to the NUL and add a NUL. */ + mch_memmove(ccline.cmdbuff, p, (size_t)ccline.cmdlen); + ccline.cmdbuff[ccline.cmdlen] = NUL; vim_free(p); if (ccline.xpc != NULL |