Skip to content

Commit

Permalink
patch 8.2.3669: buffer overflow with long help argument
Browse files Browse the repository at this point in the history
Problem:    Buffer overflow with long help argument.
Solution:   Use snprintf().
  • Loading branch information
brammool committed Nov 25, 2021
1 parent bb277fd commit bd228fd
Show file tree
Hide file tree
Showing 3 changed files with 12 additions and 2 deletions.
3 changes: 1 addition & 2 deletions src/help.c
Expand Up @@ -422,8 +422,7 @@ find_help_tags(
|| (vim_strchr((char_u *)"%_z@", arg[1]) != NULL
&& arg[2] != NUL)))
{
STRCPY(d, "/\\\\");
STRCPY(d + 3, arg + 1);
vim_snprintf((char *)d, IOSIZE, "/\\\\%s", arg + 1);
// Check for "/\\_$", should be "/\\_\$"
if (d[3] == '_' && d[4] == '$')
STRCPY(d + 4, "\\$");
Expand Down
9 changes: 9 additions & 0 deletions src/testdir/test_help.vim
Expand Up @@ -134,4 +134,13 @@ func Test_help_window_height()
close
endfunc

func Test_help_long_argument()
try
exe 'help \%' .. repeat('0', 1021)
catch
call assert_match("E149:", v:exception)
endtry
endfunc


" vim: shiftwidth=2 sts=2 expandtab
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -757,6 +757,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
3669,
/**/
3668,
/**/
Expand Down

0 comments on commit bd228fd

Please sign in to comment.