diff options
| author | Bram Moolenaar <Bram@vim.org> | 2018-02-06 22:52:49 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2018-02-06 22:52:49 +0100 |
| commit | f12519dec88251305793f1651f558d16506b4be2 (patch) | |
| tree | 8aadf8dd05eeee8a35273f34b3cff77f2ed91452 /src/normal.c | |
| parent | dd08b6a32b639b8c7a11275e04ae0a7ffc43aed0 (diff) | |
| download | vim-git-f12519dec88251305793f1651f558d16506b4be2.tar.gz | |
patch 8.0.1475: invalid memory access in read_redo()v8.0.1475
Problem: Invalid memory access in read_redo(). (gy741)
Solution: Convert the replacement character back from a negative number to
CR or NL. (hint by Dominique Pelle, closes #2616)
Diffstat (limited to 'src/normal.c')
| -rw-r--r-- | src/normal.c | 22 |
1 files changed, 16 insertions, 6 deletions
diff --git a/src/normal.c b/src/normal.c index 745a2f68c..79e0b68aa 100644 --- a/src/normal.c +++ b/src/normal.c @@ -1685,11 +1685,19 @@ do_pending_operator(cmdarg_T *cap, int old_col, int gui_yank) get_op_char(oap->op_type), get_extra_op_char(oap->op_type), oap->motion_force, cap->cmdchar, cap->nchar); else if (cap->cmdchar != ':') + { + int nchar = oap->op_type == OP_REPLACE ? cap->nchar : NUL; + + /* reverse what nv_replace() did */ + if (nchar == REPLACE_CR_NCHAR) + nchar = CAR; + else if (nchar == REPLACE_NL_NCHAR) + nchar = NL; prep_redo(oap->regname, 0L, NUL, 'v', get_op_char(oap->op_type), get_extra_op_char(oap->op_type), - oap->op_type == OP_REPLACE - ? cap->nchar : NUL); + nchar); + } if (!redo_VIsual_busy) { redo_VIsual_mode = resel_VIsual_mode; @@ -7023,10 +7031,12 @@ nv_replace(cmdarg_T *cap) reset_VIsual(); if (had_ctrl_v) { - if (cap->nchar == '\r') - cap->nchar = -1; - else if (cap->nchar == '\n') - cap->nchar = -2; + /* Use a special (negative) number to make a difference between a + * literal CR or NL and a line break. */ + if (cap->nchar == CAR) + cap->nchar = REPLACE_CR_NCHAR; + else if (cap->nchar == NL) + cap->nchar = REPLACE_NL_NCHAR; } nv_operator(cap); return; |