patch 8.1.0985: crash with large number in regexp
Problem: Crash with large number in regexp. (Kuang-che Wu)
Solution: Check for long becoming negative int. (closes #)
diff --git a/src/regexp.c b/src/regexp.c
index 5c06ada..d7c5770 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -2228,7 +2228,7 @@
default: i = -1; break;
}
- if (i < 0)
+ if (i < 0 || i > INT_MAX)
EMSG2_RET_NULL(
_("E678: Invalid character after %s%%[dxouU]"),
reg_magic == MAGIC_ALL);
@@ -3293,7 +3293,7 @@
case 'u': nr = gethexchrs(4); break;
case 'U': nr = gethexchrs(8); break;
}
- if (nr < 0)
+ if (nr < 0 || nr > INT_MAX)
{
/* If getting the number fails be backwards compatible: the character
* is a backslash. */
diff --git a/src/testdir/test_search.vim b/src/testdir/test_search.vim
index 5cf70d4..d32369d 100644
--- a/src/testdir/test_search.vim
+++ b/src/testdir/test_search.vim
@@ -1212,13 +1212,36 @@
call Incsearch_cleanup()
endfunc
-func Test_large_hex_chars()
+func Test_large_hex_chars1()
" This used to cause a crash, the character becomes an NFA state.
try
/\%Ufffffc23
catch
call assert_match('E678:', v:exception)
endtry
+ try
+ set re=1
+ /\%Ufffffc23
+ catch
+ call assert_match('E678:', v:exception)
+ endtry
+ set re&
+endfunc
+
+func Test_large_hex_chars2()
+ " This used to cause a crash, the character becomes an NFA state.
+ try
+ /[\Ufffffc1f]
+ catch
+ call assert_match('E486:', v:exception)
+ endtry
+ try
+ set re=1
+ /[\Ufffffc1f]
+ catch
+ call assert_match('E486:', v:exception)
+ endtry
+ set re&
endfunc
func Test_one_error_msg()
diff --git a/src/version.c b/src/version.c
index 74850a0..9b87302 100644
--- a/src/version.c
+++ b/src/version.c
@@ -780,6 +780,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 985,
+/**/
984,
/**/
983,