Skip to content

Commit 2a5b527

Browse files
committed
patch 8.1.1720: crash with very long %[] pattern
Problem: Crash with very long %[] pattern. (Reza Mirzazade farkhani) Solution: Check for reg_toolong. (closes #4703)
1 parent 331bafd commit 2a5b527

3 files changed

Lines changed: 17 additions & 0 deletions

File tree

src/regexp.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2175,7 +2175,11 @@ regatom(int *flagp)
21752175
if (ret == NULL)
21762176
ret = br;
21772177
else
2178+
{
21782179
regtail(lastnode, br);
2180+
if (reg_toolong)
2181+
return NULL;
2182+
}
21792183

21802184
ungetchr();
21812185
one_exactly = TRUE;
@@ -2200,6 +2204,8 @@ regatom(int *flagp)
22002204
if (OP(br) == BRANCH)
22012205
{
22022206
regtail(br, lastbranch);
2207+
if (reg_toolong)
2208+
return NULL;
22032209
br = OPERAND(br);
22042210
}
22052211
else

src/testdir/test_regexp_utf8.vim

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,3 +206,12 @@ func Test_large_class()
206206
call assert_equal(1, "\u3042" =~# '[\u3000-\u4000]')
207207
set re=0
208208
endfunc
209+
210+
func Test_optmatch_toolong()
211+
set re=1
212+
" Can only handle about 8000 characters.
213+
let pat = '\\%[' .. repeat('x', 9000) .. ']'
214+
call assert_fails('call match("abc def", "' .. pat .. '")', 'E339:')
215+
set re=0
216+
endfunc
217+

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -777,6 +777,8 @@ static char *(features[]) =
777777

778778
static int included_patches[] =
779779
{ /* Add new patch number below this line */
780+
/**/
781+
1720,
780782
/**/
781783
1719,
782784
/**/

0 commit comments

Comments
 (0)