patch 8.0.0398: illegal memory access with "t"

Problem: Illegal memory access with "t". Solution: Use strncmp() instead of memcmp(). (Dominique Pelle, closes #1528)
vim · Mar 1, 2017 · 66727e1 · 66727e1
1 parent 5a66dfb
commit 66727e1
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 5 deletions.
diff --git a/src/search.c b/src/search.c
@@ -1693,12 +1693,9 @@ searchc(cmdarg_T *cap, int t_cmd)
 		    if (p[col] == c && stop)
 			break;
 		}
-		else
+		else if (STRNCMP(p + col, lastc_bytes, lastc_bytelen) == 0
-		{
-		    if (memcmp(p + col, lastc_bytes, lastc_bytelen) == 0
 								       && stop)
-			break;
+		    break;
-		}
 		stop = TRUE;
 	    }
 	}

diff --git a/src/testdir/test_search.vim b/src/testdir/test_search.vim
@@ -294,3 +294,10 @@ func Test_searchpair()
   q!
 endfunc
 
+func Test_searchc()
+  " These commands used to cause memory overflow in searchc().
+  new
+  norm ixx
+  exe "norm 0t\u93cf"
+  bw!
+endfunc
diff --git a/src/version.c b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    398,
 /**/
     397,
 /**/