diff options
| author | Bram Moolenaar <Bram@vim.org> | 2022-05-17 20:11:02 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2022-05-17 20:11:02 +0100 |
| commit | 51f0bfb88a3554ca2dde777d78a59880d1ee37a8 (patch) | |
| tree | 5671a003b9dac08a40e60d042ba2903a0251dfec /src/ex_getln.c | |
| parent | 4748c4bd64610cf943a431d215bb1aad51f8d0b4 (diff) | |
patch 8.2.4975: recursive command line loop may cause a crashv8.2.4975
Problem: Recursive command line loop may cause a crash.
Solution: Limit recursion of getcmdline().
Diffstat (limited to 'src/ex_getln.c')
| -rw-r--r-- | src/ex_getln.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/src/ex_getln.c b/src/ex_getln.c index cbddfea003..6462b00f73 100644 --- a/src/ex_getln.c +++ b/src/ex_getln.c @@ -1581,6 +1581,7 @@ getcmdline_int( int indent, // indent for inside conditionals int clear_ccline) // clear ccline first { + static int depth = 0; // call depth int c; int i; int j; @@ -1611,6 +1612,9 @@ getcmdline_int( int cmdline_type; int wild_type; + // one recursion level deeper + ++depth; + if (ccline.cmdbuff != NULL) { // Being called recursively. Since ccline is global, we need to save @@ -1641,6 +1645,13 @@ getcmdline_int( if (init_ccline(firstc, indent) != OK) goto theend; // out of memory + if (depth == 50) + { + // Somehow got into a loop recursively calling getcmdline(), bail out. + emsg(_(e_command_too_recursive)); + goto theend; + } + ExpandInit(&xpc); ccline.xpc = &xpc; @@ -2576,6 +2587,7 @@ theend: { char_u *p = ccline.cmdbuff; + --depth; if (did_save_ccline) restore_cmdline(&save_ccline); else |