diff options
| author | Bram Moolenaar <Bram@vim.org> | 2015-06-09 20:39:24 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2015-06-09 20:39:24 +0200 |
| commit | b878bbbca67c384101c2ebb822e390f0feda9489 (patch) | |
| tree | bcf905e05baaacbe320c15b5eeacbcac92389736 | |
| parent | e2e4b98622f7c44910dc9660035048a4177d3777 (diff) | |
patch 7.4.736v7.4.736
Problem: Invalid memory access.
Solution: Avoid going over the end of a NUL terminated string. (Dominique
Pelle)
| -rw-r--r-- | src/regexp.c | 9 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 7 insertions, 4 deletions
diff --git a/src/regexp.c b/src/regexp.c index 85e0458de0..4ce37c4268 100644 --- a/src/regexp.c +++ b/src/regexp.c @@ -1157,7 +1157,7 @@ get_coll_element(pp) int l = 1; char_u *p = *pp; - if (p[1] == '.') + if (p[0] != NUL && p[1] == '.') { #ifdef FEAT_MBYTE if (has_mbyte) @@ -1228,8 +1228,9 @@ skip_anyof(p) { if (get_char_class(&p) == CLASS_NONE && get_equi_class(&p) == 0 - && get_coll_element(&p) == 0) - ++p; /* It was not a class name */ + && get_coll_element(&p) == 0 + && *p != NUL) + ++p; /* it is not a class name and not NUL */ } else ++p; @@ -3156,7 +3157,7 @@ peekchr() /* * META contains everything that may be magic sometimes, * except ^ and $ ("\^" and "\$" are only magic after - * "\v"). We now fetch the next character and toggle its + * "\V"). We now fetch the next character and toggle its * magicness. Therefore, \ is so meta-magic that it is * not in META. */ diff --git a/src/version.c b/src/version.c index f474f068ba..e1ee8c23ae 100644 --- a/src/version.c +++ b/src/version.c @@ -742,6 +742,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 736, +/**/ 735, /**/ 734, |