diff options
| author | Bram Moolenaar <Bram@vim.org> | 2022-01-25 20:45:16 +0000 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2022-01-25 20:45:16 +0000 |
| commit | 806d037671e133bd28a7864248763f643967973a (patch) | |
| tree | 64269f1fedb4fffa3f09da8e79e2db78238566ff | |
| parent | 8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa (diff) | |
patch 8.2.4218: illegal memory access with bracketed paste in Ex modev8.2.4218
Problem: Illegal memory access with bracketed paste in Ex mode.
Solution: Reserve space for the trailing NUL.
| -rw-r--r-- | src/edit.c | 3 | ||||
| -rw-r--r-- | src/testdir/test_paste.vim | 3 | ||||
| -rw-r--r-- | src/version.c | 2 |
3 files changed, 7 insertions, 1 deletions
diff --git a/src/edit.c b/src/edit.c index ee3caf0dad..2b5301100d 100644 --- a/src/edit.c +++ b/src/edit.c @@ -4452,7 +4452,8 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap) break; case PASTE_EX: - if (gap != NULL && ga_grow(gap, idx) == OK) + // add one for the NUL that is going to be appended + if (gap != NULL && ga_grow(gap, idx + 1) == OK) { mch_memmove((char *)gap->ga_data + gap->ga_len, buf, (size_t)idx); diff --git a/src/testdir/test_paste.vim b/src/testdir/test_paste.vim index c94fe7c357..5b8d8a0e3e 100644 --- a/src/testdir/test_paste.vim +++ b/src/testdir/test_paste.vim @@ -90,6 +90,9 @@ func Test_paste_ex_mode() unlet! foo call feedkeys("Qlet foo=\"\<Esc>[200~foo\<CR>bar\<Esc>[201~\"\<CR>vi\<CR>", 'xt') call assert_equal("foo\rbar", foo) + + " pasting more than 40 bytes + exe "norm Q\<PasteStart>0000000000000000000000000000000000000000000000000000000000000000000000\<C-C>" endfunc func Test_paste_onechar() diff --git a/src/version.c b/src/version.c index 6685b554f5..9dcf34928f 100644 --- a/src/version.c +++ b/src/version.c @@ -751,6 +751,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 4218, +/**/ 4217, /**/ 4216, |