diff options
| author | Bram Moolenaar <bram@vim.org> | 2015-08-04 22:02:51 +0200 |
|---|---|---|
| committer | Bram Moolenaar <bram@vim.org> | 2015-08-04 22:02:51 +0200 |
| commit | 5a50febf04df21658ecb80cd0b92724be85f4d49 (patch) | |
| tree | fa2e30ce6d14692144c772a0e04eb59f40c8b6cb | |
| parent | 8387a416fb78a8402a3e3ff5855c78055db92fe4 (diff) | |
| download | vim-5a50febf04df21658ecb80cd0b92724be85f4d49.tar.gz | |
Problem: Invalid memory access when using "exe 'sc'".
Solution: Avoid going over the end of the string. (Dominique Pelle)
| -rw-r--r-- | src/ex_docmd.c | 4 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 4 insertions, 2 deletions
diff --git a/src/ex_docmd.c b/src/ex_docmd.c index 25127575..13ed6b0a 100644 --- a/src/ex_docmd.c +++ b/src/ex_docmd.c @@ -3129,8 +3129,8 @@ find_command(eap, full) ++p; } else if (p[0] == 's' - && ((p[1] == 'c' && p[2] != 's' && p[2] != 'r' - && p[3] != 'i' && p[4] != 'p') + && ((p[1] == 'c' && (p[2] == NUL || (p[2] != 's' && p[2] != 'r' + && (p[3] == NUL || (p[3] != 'i' && p[4] != 'p'))))) || p[1] == 'g' || (p[1] == 'i' && p[2] != 'm' && p[2] != 'l' && p[2] != 'g') || p[1] == 'I' diff --git a/src/version.c b/src/version.c index 7ad08d2f..6546f6a0 100644 --- a/src/version.c +++ b/src/version.c @@ -742,6 +742,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 811, +/**/ 810, /**/ 809, |