diff options
author | Bram Moolenaar <Bram@vim.org> | 2021-04-17 21:22:49 +0200 |
---|---|---|
committer | Bram Moolenaar <Bram@vim.org> | 2021-04-17 21:22:49 +0200 |
commit | f7e92aae1581203306a340b4c0059cc74adea9d6 (patch) | |
tree | f8b79fac3095e0440114f421ed10ca4c9d785408 /src/blob.c | |
parent | d23b714d8b9ed8e16ef553098acc6da0979e94fc (diff) |
patch 8.2.2779: memory access error in remove() for blobv8.2.2779
Problem: Memory access error in remove() for blob.
Solution: Adjust length for memmove().
Diffstat (limited to 'src/blob.c')
-rw-r--r-- | src/blob.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/blob.c b/src/blob.c index 9f59777073..4685dc97c1 100644 --- a/src/blob.c +++ b/src/blob.c @@ -444,7 +444,7 @@ blob_remove(typval_T *argvars, typval_T *rettv) { blob_T *blob; - // Remove range of items, return list with values. + // Remove range of items, return blob with values. end = (long)tv_get_number_chk(&argvars[2], &error); if (error) return; @@ -472,7 +472,8 @@ blob_remove(typval_T *argvars, typval_T *rettv) rettv->v_type = VAR_BLOB; rettv->vval.v_blob = blob; - mch_memmove(p + idx, p + end + 1, (size_t)(len - end)); + if (len - end - 1 > 0) + mch_memmove(p + idx, p + end + 1, (size_t)(len - end - 1)); b->bv_ga.ga_len -= end - idx + 1; } } |