diff options
| author | Bram Moolenaar <Bram@vim.org> | 2022-07-02 12:08:16 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2022-07-02 12:08:16 +0100 |
| commit | af043e12d9e5869c597de40b9a2517ae97ac72e7 (patch) | |
| tree | 3d141f1d6710bdcbb634114f54e870dace34fef2 /src/getchar.c | |
| parent | f2ce76a8c0290af35e434e38cfe889ed0fec4c6a (diff) | |
patch 9.0.0024: may access part of typeahead buf that isn't filledv9.0.0024
Problem: May access part of typeahead buf that isn't filled.
Solution: Check length of typeahead.
Diffstat (limited to 'src/getchar.c')
| -rw-r--r-- | src/getchar.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/getchar.c b/src/getchar.c index 210a67acad..12fd1c9146 100644 --- a/src/getchar.c +++ b/src/getchar.c @@ -2437,7 +2437,8 @@ handle_mapping( int is_plug_map = FALSE; // If typehead starts with <Plug> then remap, even for a "noremap" mapping. - if (typebuf.tb_buf[typebuf.tb_off] == K_SPECIAL + if (typebuf.tb_len >= 3 + && typebuf.tb_buf[typebuf.tb_off] == K_SPECIAL && typebuf.tb_buf[typebuf.tb_off + 1] == KS_EXTRA && typebuf.tb_buf[typebuf.tb_off + 2] == KE_PLUG) is_plug_map = TRUE; |