forked from aniani/vim
patch 9.0.2111: [security]: overflow in get_number
Problem: [security]: overflow in get_number Solution: Return 0 when the count gets too large [security]: overflow in get_number When using the z= command, we may overflow the count with values larger than MAX_INT. So verify that we do not overflow and in case when an overflow is detected, simply return 0 Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
@@ -975,6 +975,8 @@ get_number(
|
||||
c = safe_vgetc();
|
||||
if (VIM_ISDIGIT(c))
|
||||
{
|
||||
if (n > INT_MAX / 10)
|
||||
return 0;
|
||||
n = n * 10 + c - '0';
|
||||
msg_putchar(c);
|
||||
++typed;
|
||||
|
Reference in New Issue
Block a user