From baefde14550231f6468ac2ed2ed495bc381c0c92 Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Thu, 7 Jul 2022 19:59:49 +0100 Subject: [PATCH] patch 9.0.0046: reading past end of completion with duplicate match Problem: Reading past end of completion with duplicate match. Solution: Check string length --- src/insexpand.c | 3 ++- src/testdir/test_ins_complete.vim | 10 ++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/src/insexpand.c b/src/insexpand.c index bf98cee..50e0579 100644 --- a/src/insexpand.c +++ b/src/insexpand.c @@ -597,7 +597,8 @@ ins_compl_add( { if ( !(match->cp_flags & CP_ORIGINAL_TEXT) && STRNCMP(match->cp_str, str, len) == 0 - && match->cp_str[len] == NUL) + && ((int)STRLEN(match->cp_str) <= len + || match->cp_str[len] == NUL)) return NOTDONE; match = match->cp_next; } while (match != NULL && match != compl_first_match); diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim index e48a72c..8f584d3 100644 --- a/src/testdir/test_ins_complete.vim +++ b/src/testdir/test_ins_complete.vim @@ -380,3 +380,13 @@ func Test_ins_completeslash() set completeslash= endfunc +func Test_ins_complete_add() + " this was reading past the end of allocated memory + new + norm o + norm 7o€€ + sil! norm o + + bwipe! +endfunc + -- 1.8.3.1