1
0
forked from aniani/vim

patch 9.0.2111: [security]: overflow in get_number

Problem:  [security]: overflow in get_number
Solution: Return 0 when the count gets too large

[security]: overflow in get_number

When using the z= command, we may overflow the count with values larger
than MAX_INT. So verify that we do not overflow and in case when an
overflow is detected, simply return 0

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt
2023-11-14 21:58:26 +01:00
parent 060623e4a3
commit 73b2d3790c
3 changed files with 13 additions and 0 deletions

View File

@@ -975,6 +975,8 @@ get_number(
c = safe_vgetc();
if (VIM_ISDIGIT(c))
{
if (n > INT_MAX / 10)
return 0;
n = n * 10 + c - '0';
msg_putchar(c);
++typed;