Skip to content

Commit 82846a0

Browse files
committed
patch 8.0.1486: accessing invalid memory with "it"
Problem: Accessing invalid memory with "it". (Dominique Pelle) Solution: Avoid going over the end of the line. (Christian Brabandt, closes #2532)
1 parent 9e33efd commit 82846a0

3 files changed

Lines changed: 18 additions & 3 deletions

File tree

src/search.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -684,11 +684,11 @@ searchit(
684684
&& pos->lnum >= 1 && pos->lnum <= buf->b_ml.ml_line_count
685685
&& pos->col < MAXCOL - 2)
686686
{
687-
ptr = ml_get_buf(buf, pos->lnum, FALSE) + pos->col;
688-
if (*ptr == NUL)
687+
ptr = ml_get_buf(buf, pos->lnum, FALSE);
688+
if ((int)STRLEN(ptr) < pos->col)
689689
start_char_len = 1;
690690
else
691-
start_char_len = (*mb_ptr2len)(ptr);
691+
start_char_len = (*mb_ptr2len)(ptr + pos->col);
692692
}
693693
#endif
694694
else

src/testdir/test_textobjects.vim

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,3 +152,16 @@ func Test_match()
152152
call assert_equal(3 , match('abc', '\zs', 3, 1))
153153
call assert_equal(-1, match('abc', '\zs', 4, 1))
154154
endfunc
155+
156+
" This was causing an illegal memory access
157+
func Test_inner_tag()
158+
new
159+
norm ixxx
160+
call feedkeys("v", 'xt')
161+
insert
162+
x
163+
x
164+
.
165+
norm it
166+
q!
167+
endfunc

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -771,6 +771,8 @@ static char *(features[]) =
771771

772772
static int included_patches[] =
773773
{ /* Add new patch number below this line */
774+
/**/
775+
1486,
774776
/**/
775777
1485,
776778
/**/

0 commit comments

Comments
 (0)