aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-23 03:43:49 -04:00
Code Activity

patch 8.1.0985: crash with large number in regexp

Browse Source 
Problem:    Crash with large number in regexp. (Kuang-che Wu)
Solution:   Check for long becoming negative int. (closes #)
This commit is contained in:
Bram Moolenaar
2019-02-28 06:25:00 +01:00
parent c69efcb42f
commit ab350f89f9
3 changed files with 28 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/regexp.c
View File

@@ -2228,7 +2228,7 @@ regatom(int *flagp)
default: i = -1; break;
}
if (i < 0)
if (i < 0 || i > INT_MAX)
EMSG2_RET_NULL(
_("E678: Invalid character after %s%%[dxouU]"),
reg_magic == MAGIC_ALL);
@@ -3293,7 +3293,7 @@ coll_get_char(void)
case 'u': nr = gethexchrs(4); break;
case 'U': nr = gethexchrs(8); break;
}
if (nr < 0)
if (nr < 0 || nr > INT_MAX)
{
/* If getting the number fails be backwards compatible: the character
* is a backslash. */