diff options
| author | Bram Moolenaar <Bram@vim.org> | 2022-05-06 20:38:47 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2022-05-06 20:38:47 +0100 |
| commit | d88934406c5375d88f8f1b65331c9f0cab68cc6c (patch) | |
| tree | 1d494ce256adb31317dd457e16999c37fa701972 /src/ex_docmd.c | |
| parent | 5a7b6dc23cd16450b5773849520d513de56bccbf (diff) | |
patch 8.2.4895: buffer overflow with invalid command with composing charsv8.2.4895
Problem: Buffer overflow with invalid command with composing chars.
Solution: Check that the whole character fits in the buffer.
Diffstat (limited to 'src/ex_docmd.c')
| -rw-r--r-- | src/ex_docmd.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/ex_docmd.c b/src/ex_docmd.c index 26acc07e0f..46f2b221b3 100644 --- a/src/ex_docmd.c +++ b/src/ex_docmd.c @@ -3435,7 +3435,7 @@ append_command(char_u *cmd) STRCAT(IObuff, ": "); d = IObuff + STRLEN(IObuff); - while (*s != NUL && d - IObuff < IOSIZE - 7) + while (*s != NUL && d - IObuff + 5 < IOSIZE) { if (enc_utf8 ? (s[0] == 0xc2 && s[1] == 0xa0) : *s == 0xa0) { @@ -3443,6 +3443,8 @@ append_command(char_u *cmd) STRCPY(d, "<a0>"); d += 4; } + else if (d - IObuff + (*mb_ptr2len)(s) + 1 >= IOSIZE) + break; else MB_COPY_CHAR(s, d); } |