vim/backport-CVE-2023-0433.patch
2023-02-06 16:32:33 +08:00

41 lines
1.3 KiB
Diff

From 11977f917506d950b7e0cae558bd9189260b253b Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 21 Jan 2023 13:09:19 +0000
Subject: [PATCH] patch 9.0.1225: reading past the end of a line when
formatting text
Problem: Reading past the end of a line when formatting text.
Solution: Check for not going over the end of the line.
---
src/textformat.c | 10 +++++++++-
1 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/textformat.c b/src/textformat.c
index 6a93890bd2c4..7ebbc8849a45 100644
--- a/src/textformat.c
+++ b/src/textformat.c
@@ -540,6 +540,9 @@ same_leader(
if (leader1_len == 0)
return (leader2_len == 0);
+ char_u *lnum_line = NULL;
+ int line_len = 0;
+
// If first leader has 'f' flag, the lines can be joined only if the
// second line does not have a leader.
// If first leader has 'e' flag, the lines can never be joined.
@@ -555,7 +558,12 @@ same_leader(
return FALSE;
if (*p == COM_START)
{
- if (*(ml_get(lnum) + leader1_len) == NUL)
+ if (lnum_line == NULL)
+ {
+ lnum_line = ml_get(lnum);
+ line_len = (int)STRLEN(lnum_line);
+ }
+ if (line_len <= leader1_len)
return FALSE;
if (leader2_flags == NULL || leader2_len == 0)
return FALSE;