Skip to content

Commit

Permalink
patch 9.0.0060: accessing uninitialized memory when completing long line
Browse files Browse the repository at this point in the history
Problem:    Accessing uninitialized memory when completing long line.
Solution:   Terminate string with NUL.
  • Loading branch information
brammool committed Jul 23, 2022
1 parent bb404f5 commit b9e7173
Show file tree
Hide file tree
Showing 3 changed files with 10 additions and 0 deletions.
1 change: 1 addition & 0 deletions src/insexpand.c
Expand Up @@ -642,6 +642,7 @@ ins_compl_infercase_gettext(
// growarray. Add the character in the next round.
if (ga_grow(&gap, IOSIZE) == FAIL)
return (char_u *)"[failed]";
*p = NUL;
STRCPY(gap.ga_data, IObuff);
gap.ga_len = (int)STRLEN(IObuff);
}
Expand Down
7 changes: 7 additions & 0 deletions src/testdir/test_ins_complete.vim
Expand Up @@ -2108,6 +2108,13 @@ func Test_infercase_very_long_line()
exe "normal 2Go\<C-X>\<C-L>\<Esc>"
call assert_equal(longLine, getline(3))

" check that the too long text is NUL terminated
%del
norm o
norm 1987ax
exec "norm ox\<C-X>\<C-L>"
call assert_equal(repeat('x', 1987), getline(3))

bwipe!
set noic noinfercase
endfunc
Expand Down
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -735,6 +735,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
60,
/**/
59,
/**/
Expand Down

0 comments on commit b9e7173

Please sign in to comment.