0
0
mirror of https://github.com/vim/vim.git synced 2025-09-24 03:44:06 -04:00

patch 8.2.4206: condition with many "(" causes a crash

Problem:    Condition with many "(" causes a crash.
Solution:   Limit recursion to 1000.
This commit is contained in:
Bram Moolenaar
2022-01-24 18:16:12 +00:00
parent 4663435074
commit fe6fb267e6
4 changed files with 25 additions and 1 deletions

View File

@@ -3526,6 +3526,7 @@ eval7(
char_u *start_leader, *end_leader;
int ret = OK;
char_u *alias;
static int recurse = 0;
/*
* Initialise variable so that clear_tv() can't mistake this for a
@@ -3552,6 +3553,15 @@ eval7(
return FAIL;
}
// Limit recursion to 1000 levels. At least at 10000 we run out of stack
// and crash.
if (recurse == 1000)
{
semsg(_(e_expression_too_recursive_str), *arg);
return FAIL;
}
++recurse;
switch (**arg)
{
/*
@@ -3781,6 +3791,8 @@ eval7(
*/
if (ret == OK && evaluate && end_leader > start_leader)
ret = eval7_leader(rettv, FALSE, start_leader, &end_leader);
--recurse;
return ret;
}