patch 8.2.3669: buffer overflow with long help argument
Problem: Buffer overflow with long help argument.
Solution: Use snprintf().
diff --git a/src/help.c b/src/help.c
index 28d914c..d67f78b 100644
--- a/src/help.c
+++ b/src/help.c
@@ -422,8 +422,7 @@
|| (vim_strchr((char_u *)"%_z@", arg[1]) != NULL
&& arg[2] != NUL)))
{
- STRCPY(d, "/\\\\");
- STRCPY(d + 3, arg + 1);
+ vim_snprintf((char *)d, IOSIZE, "/\\\\%s", arg + 1);
// Check for "/\\_$", should be "/\\_\$"
if (d[3] == '_' && d[4] == '$')
STRCPY(d + 4, "\\$");
diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
index 15cc642..6e32edd 100644
--- a/src/testdir/test_help.vim
+++ b/src/testdir/test_help.vim
@@ -134,4 +134,13 @@
close
endfunc
+func Test_help_long_argument()
+ try
+ exe 'help \%' .. repeat('0', 1021)
+ catch
+ call assert_match("E149:", v:exception)
+ endtry
+endfunc
+
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index a225e18..da5871e 100644
--- a/src/version.c
+++ b/src/version.c
@@ -758,6 +758,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 3669,
+/**/
3668,
/**/
3667,