diff options
| author | Bram Moolenaar <Bram@vim.org> | 2017-08-06 18:15:45 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2017-08-06 18:15:45 +0200 |
| commit | 1c864093f93b0066de25d6c0ddf03a6bc6b1c870 (patch) | |
| tree | d347a56a3addc4016581a4f4b1c5a465d470d48d /src/misc1.c | |
| parent | 4535654246936de13eafd4e049b0a1991521fba4 (diff) | |
| download | vim-git-1c864093f93b0066de25d6c0ddf03a6bc6b1c870.tar.gz | |
patch 8.0.0883: invalid memory access with nonsensical scriptv8.0.0883
Problem: Invalid memory access with nonsensical script.
Solution: Check "dstlen" being positive. (Dominique Pelle)
Diffstat (limited to 'src/misc1.c')
| -rw-r--r-- | src/misc1.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/src/misc1.c b/src/misc1.c index 4e51bed25..5f8b092c0 100644 --- a/src/misc1.c +++ b/src/misc1.c @@ -4180,13 +4180,18 @@ expand_env_esc( } else if ((src[0] == ' ' || src[0] == ',') && !one) at_start = TRUE; - *dst++ = *src++; - --dstlen; + if (dstlen > 0) + { + *dst++ = *src++; + --dstlen; - if (startstr != NULL && src - startstr_len >= srcp - && STRNCMP(src - startstr_len, startstr, startstr_len) == 0) - at_start = TRUE; + if (startstr != NULL && src - startstr_len >= srcp + && STRNCMP(src - startstr_len, startstr, + startstr_len) == 0) + at_start = TRUE; + } } + } *dst = NUL; } |