1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
To: vim_dev@googlegroups.com
Subject: Patch 8.1.0985
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------
Patch 8.1.0985
Problem: Crash with large number in regexp. (Kuang-che Wu)
Solution: Check for long becoming negative int. (closes #)
Files: src/regexp.c, src/testdir/test_search.vim
*** ../vim-8.1.0984/src/regexp.c 2019-02-22 17:26:57.739029029 +0100
--- src/regexp.c 2019-02-28 06:23:19.097348062 +0100
***************
*** 2228,2234 ****
default: i = -1; break;
}
! if (i < 0)
EMSG2_RET_NULL(
_("E678: Invalid character after %s%%[dxouU]"),
reg_magic == MAGIC_ALL);
--- 2228,2234 ----
default: i = -1; break;
}
! if (i < 0 || i > INT_MAX)
EMSG2_RET_NULL(
_("E678: Invalid character after %s%%[dxouU]"),
reg_magic == MAGIC_ALL);
***************
*** 3293,3299 ****
case 'u': nr = gethexchrs(4); break;
case 'U': nr = gethexchrs(8); break;
}
! if (nr < 0)
{
/* If getting the number fails be backwards compatible: the character
* is a backslash. */
--- 3293,3299 ----
case 'u': nr = gethexchrs(4); break;
case 'U': nr = gethexchrs(8); break;
}
! if (nr < 0 || nr > INT_MAX)
{
/* If getting the number fails be backwards compatible: the character
* is a backslash. */
*** ../vim-8.1.0984/src/testdir/test_search.vim 2019-02-22 17:26:57.735029052 +0100
--- src/testdir/test_search.vim 2019-02-28 06:22:23.121696028 +0100
***************
*** 1212,1224 ****
call Incsearch_cleanup()
endfunc
! func Test_large_hex_chars()
" This used to cause a crash, the character becomes an NFA state.
try
/\%Ufffffc23
catch
call assert_match('E678:', v:exception)
endtry
endfunc
func Test_one_error_msg()
--- 1212,1247 ----
call Incsearch_cleanup()
endfunc
! func Test_large_hex_chars1()
" This used to cause a crash, the character becomes an NFA state.
try
/\%Ufffffc23
catch
call assert_match('E678:', v:exception)
endtry
+ try
+ set re=1
+ /\%Ufffffc23
+ catch
+ call assert_match('E678:', v:exception)
+ endtry
+ set re&
+ endfunc
+
+ func Test_large_hex_chars2()
+ " This used to cause a crash, the character becomes an NFA state.
+ try
+ /[\Ufffffc1f]
+ catch
+ call assert_match('E486:', v:exception)
+ endtry
+ try
+ set re=1
+ /[\Ufffffc1f]
+ catch
+ call assert_match('E486:', v:exception)
+ endtry
+ set re&
endfunc
func Test_one_error_msg()
*** ../vim-8.1.0984/src/version.c 2019-02-27 14:11:56.977675599 +0100
--- src/version.c 2019-02-28 06:24:21.756953772 +0100
***************
*** 781,782 ****
--- 781,784 ----
{ /* Add new patch number below this line */
+ /**/
+ 985,
/**/
--
How To Keep A Healthy Level Of Insanity:
12. Sing along at the opera.
/// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\
/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ an exciting new programming language -- http://www.Zimbu.org ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///
|
