Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
patch 8.2.4763: using invalid pointer with "V:" in Ex mode
Problem:    Using invalid pointer with "V:" in Ex mode.
Solution:   Correctly handle the command being changed to "+".
  • Loading branch information
brammool committed Apr 16, 2022
1 parent ca7e86c commit f50808e
Show file tree
Hide file tree
Showing 3 changed files with 39 additions and 5 deletions.
29 changes: 24 additions & 5 deletions src/ex_docmd.c
Expand Up @@ -2783,7 +2783,9 @@ parse_command_modifiers(
cmdmod_T *cmod,
int skip_only)
{
char_u *orig_cmd = eap->cmd;
char_u *cmd_start = NULL;
int did_plus_cmd = FALSE;
char_u *p;
int starts_with_colon = FALSE;
int vim9script = in_vim9script();
Expand Down Expand Up @@ -2819,6 +2821,7 @@ parse_command_modifiers(
&& curwin->w_cursor.lnum < curbuf->b_ml.ml_line_count)
{
eap->cmd = (char_u *)"+";
did_plus_cmd = TRUE;
if (!skip_only)
ex_pressedreturn = TRUE;
}
Expand Down Expand Up @@ -3105,13 +3108,29 @@ parse_command_modifiers(
// Since the modifiers have been parsed put the colon on top of the
// space: "'<,'>mod cmd" -> "mod:'<,'>cmd
// Put eap->cmd after the colon.
mch_memmove(cmd_start - 5, cmd_start, eap->cmd - cmd_start);
eap->cmd -= 5;
mch_memmove(eap->cmd - 1, ":'<,'>", 6);
if (did_plus_cmd)
{
size_t len = STRLEN(cmd_start);

// Special case: empty command may have been changed to "+":
// "'<,'>mod" -> "mod'<,'>+
mch_memmove(orig_cmd, cmd_start, len);
STRCPY(orig_cmd + len, "'<,'>+");
}
else
{
mch_memmove(cmd_start - 5, cmd_start, eap->cmd - cmd_start);
eap->cmd -= 5;
mch_memmove(eap->cmd - 1, ":'<,'>", 6);
}
}
else
// no modifiers, move the pointer back
eap->cmd -= 5;
// No modifiers, move the pointer back.
// Special case: empty command may have been changed to "+".
if (did_plus_cmd)
eap->cmd = (char_u *)"'<,'>+";
else
eap->cmd = orig_cmd;
}

return OK;
Expand Down
13 changes: 13 additions & 0 deletions src/testdir/test_ex_mode.vim
Expand Up @@ -250,5 +250,18 @@ func Test_ex_mode_large_indent()
bwipe!
endfunc

" This was accessing illegal memory when using "+" for eap->cmd.
func Test_empty_command_visual_mode()
let lines =<< trim END
r<sfile>
0norm0V:
:qall!
END
call writefile(lines, 'Xexmodescript')
call assert_equal(1, RunVim([], [], '-u NONE -e -s -S Xexmodescript'))

call delete('Xexmodescript')
endfunc


" vim: shiftwidth=2 sts=2 expandtab
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -746,6 +746,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
4763,
/**/
4762,
/**/
Expand Down

0 comments on commit f50808e

Please sign in to comment.