commit 85b6747abc15a7a81086db31289cf1b8b17e6cb1
author Bram Moolenaar <Bram@vim.org> Tue Jan 25 11:55:02 2022 +0000
committer Bram Moolenaar <Bram@vim.org> Tue Jan 25 11:55:02 2022 +0000
tree 5fbac72647079ea80b7a09895c9cd2ff4e62f0db
parent 76687d27173e64d739ea371751697c03ad0821ef

patch 8.2.4214: illegal memory access with large 'tabstop' in Ex mode

Problem:    Illegal memory access with large 'tabstop' in Ex mode.
Solution:   Allocate enough memory.

src/ex_getln.c

diff --git a/src/ex_getln.c b/src/ex_getln.c
index 5dc43d8..097b97e 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -1513,7 +1513,7 @@
     ccline.cmdindent = (firstc > 0 ? indent : 0);
 
     // alloc initial ccline.cmdbuff
-    alloc_cmdbuff(exmode_active ? 250 : indent + 1);
+    alloc_cmdbuff(indent + 50);
     if (ccline.cmdbuff == NULL)
 	return FAIL;
     ccline.cmdlen = ccline.cmdpos = 0;

src/testdir/test_ex_mode.vim

diff --git a/src/testdir/test_ex_mode.vim b/src/testdir/test_ex_mode.vim
index 7031115..2642a16 100644
--- a/src/testdir/test_ex_mode.vim
+++ b/src/testdir/test_ex_mode.vim
@@ -241,4 +241,14 @@
   call delete('Xexmodescript')
 endfunc
 
+func Test_ex_mode_large_indent()
+  new
+  set ts=500 ai
+  call setline(1, "\t")
+  exe "normal gQi\<CR>."
+  set ts=8 noai
+  bwipe!
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

src/version.c

diff --git a/src/version.c b/src/version.c
index 2846ea9..5d7eccb 100644
--- a/src/version.c
+++ b/src/version.c
@@ -751,6 +751,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    4214,
+/**/
     4213,
 /**/
     4212,