Skip to content

Commit b9e7173

Browse files
committed
patch 9.0.0060: accessing uninitialized memory when completing long line
Problem: Accessing uninitialized memory when completing long line. Solution: Terminate string with NUL.
1 parent bb404f5 commit b9e7173

File tree

3 files changed

+10
-0
lines changed

3 files changed

+10
-0
lines changed

src/insexpand.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -642,6 +642,7 @@ ins_compl_infercase_gettext(
642642
// growarray. Add the character in the next round.
643643
if (ga_grow(&gap, IOSIZE) == FAIL)
644644
return (char_u *)"[failed]";
645+
*p = NUL;
645646
STRCPY(gap.ga_data, IObuff);
646647
gap.ga_len = (int)STRLEN(IObuff);
647648
}

src/testdir/test_ins_complete.vim

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2108,6 +2108,13 @@ func Test_infercase_very_long_line()
21082108
exe "normal 2Go\<C-X>\<C-L>\<Esc>"
21092109
call assert_equal(longLine, getline(3))
21102110

2111+
" check that the too long text is NUL terminated
2112+
%del
2113+
norm o
2114+
norm 1987ax
2115+
exec "norm ox\<C-X>\<C-L>"
2116+
call assert_equal(repeat('x', 1987), getline(3))
2117+
21112118
bwipe!
21122119
set noic noinfercase
21132120
endfunc

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -735,6 +735,8 @@ static char *(features[]) =
735735

736736
static int included_patches[] =
737737
{ /* Add new patch number below this line */
738+
/**/
739+
60,
738740
/**/
739741
59,
740742
/**/

0 commit comments

Comments
 (0)