commit bd228fd097b41a798f90944b5d1245eddd484142
author Bram Moolenaar <Bram@vim.org> Thu Nov 25 10:50:12 2021 +0000
committer Bram Moolenaar <Bram@vim.org> Thu Nov 25 10:50:12 2021 +0000
tree ed9a086f58a1ce7dc970be1fc3495fd278dd4936
parent bb277fd89fd7c665d51be2a08993732d46c208ef

patch 8.2.3669: buffer overflow with long help argument

Problem:    Buffer overflow with long help argument.
Solution:   Use snprintf().

src/help.c

diff --git a/src/help.c b/src/help.c
index 28d914c..d67f78b 100644
--- a/src/help.c
+++ b/src/help.c
@@ -422,8 +422,7 @@
 		    || (vim_strchr((char_u *)"%_z@", arg[1]) != NULL
 							   && arg[2] != NUL)))
 	{
-	    STRCPY(d, "/\\\\");
-	    STRCPY(d + 3, arg + 1);
+	    vim_snprintf((char *)d, IOSIZE, "/\\\\%s", arg + 1);
 	    // Check for "/\\_$", should be "/\\_\$"
 	    if (d[3] == '_' && d[4] == '$')
 		STRCPY(d + 4, "\\$");