diff options
| author | Bram Moolenaar <bram@vim.org> | 2010-05-28 21:31:58 +0200 |
|---|---|---|
| committer | Bram Moolenaar <bram@vim.org> | 2010-05-28 21:31:58 +0200 |
| commit | a956585a991639fc0889f45b51d2bc417d1a0cf1 (patch) | |
| tree | 4dce6f7b20d358a3c7750fd63bafba50550cc99f | |
| parent | 279a70885c0a83221be7e3023988a59dfc91beb3 (diff) | |
| download | vim-7-2-439.tar.gz | |
updated for version 7.2.439v7-2-439
Problem: Invalid memory access when doing thesaurus completion and
'infercase' is set.
Solution: Use the minimal length of completed word and replacement.
(Dominique Pelle)
| -rw-r--r-- | src/edit.c | 12 |
1 files changed, 9 insertions, 3 deletions
@@ -2164,6 +2164,7 @@ ins_compl_add_infercase(str, len, icase, fname, dir, flags) int i, c; int actual_len; /* Take multi-byte characters */ int actual_compl_length; /* into account. */ + int min_len; int *wca; /* Wide character array. */ int has_lower = FALSE; int was_letter = FALSE; @@ -2204,6 +2205,11 @@ ins_compl_add_infercase(str, len, icase, fname, dir, flags) #endif actual_compl_length = compl_length; + /* "actual_len" may be smaller than "actual_compl_length" when using + * thesaurus, only use the minimum when comparing. */ + min_len = actual_len < actual_compl_length + ? actual_len : actual_compl_length; + /* Allocate wide character array for the completion and fill it. */ wca = (int *)alloc((unsigned)(actual_len * sizeof(int))); if (wca != NULL) @@ -2219,7 +2225,7 @@ ins_compl_add_infercase(str, len, icase, fname, dir, flags) /* Rule 1: Were any chars converted to lower? */ p = compl_orig_text; - for (i = 0; i < actual_compl_length; ++i) + for (i = 0; i < min_len; ++i) { #ifdef FEAT_MBYTE if (has_mbyte) @@ -2247,7 +2253,7 @@ ins_compl_add_infercase(str, len, icase, fname, dir, flags) if (!has_lower) { p = compl_orig_text; - for (i = 0; i < actual_compl_length; ++i) + for (i = 0; i < min_len; ++i) { #ifdef FEAT_MBYTE if (has_mbyte) @@ -2268,7 +2274,7 @@ ins_compl_add_infercase(str, len, icase, fname, dir, flags) /* Copy the original case of the part we typed. */ p = compl_orig_text; - for (i = 0; i < actual_compl_length; ++i) + for (i = 0; i < min_len; ++i) { #ifdef FEAT_MBYTE if (has_mbyte) |