diff options
| author | Bram Moolenaar <Bram@vim.org> | 2018-02-04 16:38:47 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2018-02-04 16:38:47 +0100 |
| commit | 191f18bad0b5c48afa05c3e8a00f3ced993f6a38 (patch) | |
| tree | 0aed9e0d035e54bf4446623926d55b7ae524d684 /src/misc1.c | |
| parent | fef4ddd5eb8816a6607a624aa401bcfa71a63def (diff) | |
patch 8.0.1468: illegal memory access in del_bytes()v8.0.1468
Problem: Illegal memory access in del_bytes().
Solution: Check for negative byte count. (Christian Brabandt, closes #2466)
Diffstat (limited to 'src/misc1.c')
| -rw-r--r-- | src/misc1.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/src/misc1.c b/src/misc1.c index 726500a4c8..593dce1c3d 100644 --- a/src/misc1.c +++ b/src/misc1.c @@ -2457,7 +2457,7 @@ del_chars(long count, int fixpos) * If "fixpos" is TRUE, don't leave the cursor on the NUL after the line. * Caller must have prepared for undo. * - * return FAIL for failure, OK otherwise + * Return FAIL for failure, OK otherwise. */ int del_bytes( @@ -2476,12 +2476,21 @@ del_bytes( oldp = ml_get(lnum); oldlen = (int)STRLEN(oldp); - /* - * Can't do anything when the cursor is on the NUL after the line. - */ + /* Can't do anything when the cursor is on the NUL after the line. */ if (col >= oldlen) return FAIL; + /* If "count" is zero there is nothing to do. */ + if (count == 0) + return OK; + + /* If "count" is negative the caller must be doing something wrong. */ + if (count < 1) + { + IEMSGN("E950: Invalid count for del_bytes(): %ld", count); + return FAIL; + } + #ifdef FEAT_MBYTE /* If 'delcombine' is set and deleting (less than) one character, only * delete the last combining character. */ |