From af043e12d9e5869c597de40b9a2517ae97ac72e7 Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Sat, 2 Jul 2022 12:08:16 +0100 Subject: [PATCH] patch 9.0.0024: may access part of typeahead buf that isn't filled Problem: May access part of typeahead buf that isn't filled. Solution: Check length of typeahead. --- src/getchar.c | 3 ++- src/version.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/getchar.c b/src/getchar.c index 210a67aca..12fd1c914 100644 --- a/src/getchar.c +++ b/src/getchar.c @@ -2437,7 +2437,8 @@ handle_mapping( int is_plug_map = FALSE; // If typehead starts with then remap, even for a "noremap" mapping. - if (typebuf.tb_buf[typebuf.tb_off] == K_SPECIAL + if (typebuf.tb_len >= 3 + && typebuf.tb_buf[typebuf.tb_off] == K_SPECIAL && typebuf.tb_buf[typebuf.tb_off + 1] == KS_EXTRA && typebuf.tb_buf[typebuf.tb_off + 2] == KE_PLUG) is_plug_map = TRUE; diff --git a/src/version.c b/src/version.c index fe683f4dd..e8d506c90 100644 --- a/src/version.c +++ b/src/version.c @@ -735,6 +735,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 24, /**/ 23, /**/