patch 9.0.1848: [security] buffer-overflow in vim_regsub_both()
Problem: buffer-overflow in vim_regsub_both()
Solution: Check remaining space
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/regexp.c b/src/regexp.c
index 9c576c6..edd1293 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -2051,7 +2051,8 @@
// "flags & REGSUB_COPY" != 0.
if (copy)
{
- if (eval_result[nested] != NULL)
+ if (eval_result[nested] != NULL &&
+ STRLEN(eval_result[nested]) < destlen)
{
STRCPY(dest, eval_result[nested]);
dst += STRLEN(eval_result[nested]);