IntenseFinance/neovim
3
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-02-25 18:55:25 -06:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.3669: buffer overflow with long help argument (#16971)

Browse Source 
Problem:    Buffer overflow with long help argument.
Solution:   Use snprintf().
bd228fd097
This commit is contained in:
f380cedric 2022-01-27 14:58:53 +01:00 committed by GitHub
parent 39d6db3899
commit 5182627ce9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/nvim/ex_cmds.c
View File

@ -5071,8 +5071,7 @@ int find_help_tags(const char_u *arg, int *num_matches, char_u ***matches, bool
&& ((arg[1] != NUL && arg[2] == NUL)
|| (vim_strchr((char_u *)"%_z@", arg[1]) != NULL
&& arg[2] != NUL))) {
STRCPY(d, "/\\\\");
STRCPY(d + 3, arg + 1);
vim_snprintf((char *)d, IOSIZE, "/\\\\%s", arg + 1);
// Check for "/\\_$", should be "/\\_\$"
if (d[3] == '_' && d[4] == '$') {
STRCPY(d + 4, "\\$");

8
src/nvim/testdir/test_help.vim
View File

@ -101,4 +101,12 @@ func Test_helptag_cmd()
call delete('Xdir', 'rf')
endfunc
func Test_help_long_argument()
try
exe 'help \%' .. repeat('0', 1021)
catch
call assert_match("E149:", v:exception)
endtry
endfunc
" vim: shiftwidth=2 sts=2 expandtab