diff options
| author | Bram Moolenaar <Bram@vim.org> | 2020-05-24 18:45:07 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2020-05-24 18:45:07 +0200 |
| commit | f7271e831614d15d173c7f562cc26f48c2554ce9 (patch) | |
| tree | a316046ede49d1eac2708a20121f25d971a2da8c /src/eval.c | |
| parent | 87202264f8e27f084c0e58f98aeb27fa5c6d5251 (diff) | |
patch 8.2.0817: not enough memory allocated when converting stringv8.2.0817
Problem: Not enough memory allocated when converting string with special
character.
Solution: Reserve space for modifier code. (closes #6130)
Diffstat (limited to 'src/eval.c')
| -rw-r--r-- | src/eval.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/src/eval.c b/src/eval.c index dbc10c1b69..00b6c59df2 100644 --- a/src/eval.c +++ b/src/eval.c @@ -3503,6 +3503,7 @@ get_string_tv(char_u **arg, typval_T *rettv, int evaluate) char_u *p; char_u *name; int extra = 0; + int len; /* * Find the end of the string, skipping backslashed characters. @@ -3513,9 +3514,10 @@ get_string_tv(char_u **arg, typval_T *rettv, int evaluate) { ++p; // A "\<x>" form occupies at least 4 characters, and produces up - // to 6 characters: reserve space for 2 extra + // to 9 characters (6 for the char and 3 for a modifier): reserve + // space for 5 extra. if (*p == '<') - extra += 2; + extra += 5; } } @@ -3536,7 +3538,8 @@ get_string_tv(char_u **arg, typval_T *rettv, int evaluate) * Copy the string into allocated memory, handling backslashed * characters. */ - name = alloc(p - *arg + extra); + len = (int)(p - *arg + extra); + name = alloc(len); if (name == NULL) return FAIL; rettv->v_type = VAR_STRING; @@ -3610,6 +3613,8 @@ get_string_tv(char_u **arg, typval_T *rettv, int evaluate) if (extra != 0) { name += extra; + if (name >= rettv->vval.v_string + len) + iemsg("get_string_tv() used more space than allocated"); break; } // FALLTHROUGH |