diff options
| author | Bram Moolenaar <bram@vim.org> | 2015-06-09 20:39:24 +0200 |
|---|---|---|
| committer | Bram Moolenaar <bram@vim.org> | 2015-06-09 20:39:24 +0200 |
| commit | 05f4bebdb9adbd680724123fb8122462881eb1c5 (patch) | |
| tree | a693bb6ab61b33fc47f9a9e9f911801d8408b953 | |
| parent | 214253e520fc5edb05853c82d03d35c5337b7904 (diff) | |
| download | vim-05f4bebdb9adbd680724123fb8122462881eb1c5.tar.gz | |
Problem: Invalid memory access.
Solution: Avoid going over the end of a NUL terminated string. (Dominique
Pelle)
| -rw-r--r-- | src/regexp.c | 9 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 7 insertions, 4 deletions
diff --git a/src/regexp.c b/src/regexp.c index 85e0458d..4ce37c42 100644 --- a/src/regexp.c +++ b/src/regexp.c @@ -1157,7 +1157,7 @@ get_coll_element(pp) int l = 1; char_u *p = *pp; - if (p[1] == '.') + if (p[0] != NUL && p[1] == '.') { #ifdef FEAT_MBYTE if (has_mbyte) @@ -1228,8 +1228,9 @@ skip_anyof(p) { if (get_char_class(&p) == CLASS_NONE && get_equi_class(&p) == 0 - && get_coll_element(&p) == 0) - ++p; /* It was not a class name */ + && get_coll_element(&p) == 0 + && *p != NUL) + ++p; /* it is not a class name and not NUL */ } else ++p; @@ -3156,7 +3157,7 @@ peekchr() /* * META contains everything that may be magic sometimes, * except ^ and $ ("\^" and "\$" are only magic after - * "\v"). We now fetch the next character and toggle its + * "\V"). We now fetch the next character and toggle its * magicness. Therefore, \ is so meta-magic that it is * not in META. */ diff --git a/src/version.c b/src/version.c index f474f068..e1ee8c23 100644 --- a/src/version.c +++ b/src/version.c @@ -742,6 +742,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 736, +/**/ 735, /**/ 734, |