Skip to content

Commit

Permalink
patch 8.2.4975: recursive command line loop may cause a crash
Browse files Browse the repository at this point in the history
Problem:    Recursive command line loop may cause a crash.
Solution:   Limit recursion of getcmdline().
  • Loading branch information
brammool committed May 17, 2022
1 parent 4748c4b commit 51f0bfb
Show file tree
Hide file tree
Showing 3 changed files with 26 additions and 0 deletions.
12 changes: 12 additions & 0 deletions src/ex_getln.c
Expand Up @@ -1581,6 +1581,7 @@ getcmdline_int(
int indent, // indent for inside conditionals
int clear_ccline) // clear ccline first
{
static int depth = 0; // call depth
int c;
int i;
int j;
Expand Down Expand Up @@ -1611,6 +1612,9 @@ getcmdline_int(
int cmdline_type;
int wild_type;

// one recursion level deeper
++depth;

if (ccline.cmdbuff != NULL)
{
// Being called recursively. Since ccline is global, we need to save
Expand Down Expand Up @@ -1641,6 +1645,13 @@ getcmdline_int(
if (init_ccline(firstc, indent) != OK)
goto theend; // out of memory

if (depth == 50)
{
// Somehow got into a loop recursively calling getcmdline(), bail out.
emsg(_(e_command_too_recursive));
goto theend;
}

ExpandInit(&xpc);
ccline.xpc = &xpc;

Expand Down Expand Up @@ -2576,6 +2587,7 @@ getcmdline_int(
{
char_u *p = ccline.cmdbuff;

--depth;
if (did_save_ccline)
restore_cmdline(&save_ccline);
else
Expand Down
12 changes: 12 additions & 0 deletions src/testdir/test_cmdline.vim
Expand Up @@ -3392,4 +3392,16 @@ func Test_screenpos_and_completion()
call feedkeys(":let a\<C-R>=Check_completion()\<CR>\<Esc>", "xt")
endfunc

func Test_recursive_register()
let @= = ''
silent! ?e/
let caught = 'no'
try
normal //
catch /E169:/
let caught = 'yes'
endtry
call assert_equal('yes', caught)
endfunc

" vim: shiftwidth=2 sts=2 expandtab
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -746,6 +746,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
4975,
/**/
4974,
/**/
Expand Down

0 comments on commit 51f0bfb

Please sign in to comment.