Blame SOURCES/0001-patch-8.2.4218-illegal-memory-access-with-bracketed-.patch

13ea7f
From 806d037671e133bd28a7864248763f643967973a Mon Sep 17 00:00:00 2001
13ea7f
From: Bram Moolenaar <Bram@vim.org>
13ea7f
Date: Tue, 25 Jan 2022 20:45:16 +0000
13ea7f
Subject: [PATCH] patch 8.2.4218: illegal memory access with bracketed paste in
13ea7f
 Ex mode
13ea7f
13ea7f
Problem:    Illegal memory access with bracketed paste in Ex mode.
13ea7f
Solution:   Reserve space for the trailing NUL.
13ea7f
---
13ea7f
 src/edit.c                 | 3 ++-
13ea7f
 src/testdir/test_paste.vim | 3 +++
13ea7f
 src/version.c              | 2 ++
13ea7f
 3 files changed, 7 insertions(+), 1 deletion(-)
13ea7f
13ea7f
diff --git a/src/edit.c b/src/edit.c
13ea7f
index ee3caf0da..2b5301100 100644
13ea7f
--- a/src/edit.c
13ea7f
+++ b/src/edit.c
13ea7f
@@ -4452,7 +4452,8 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
13ea7f
 		    break;
13ea7f
 
13ea7f
 		case PASTE_EX:
13ea7f
-		    if (gap != NULL && ga_grow(gap, idx) == OK)
13ea7f
+		    // add one for the NUL that is going to be appended
13ea7f
+		    if (gap != NULL && ga_grow(gap, idx + 1) == OK)
13ea7f
 		    {
13ea7f
 			mch_memmove((char *)gap->ga_data + gap->ga_len,
13ea7f
 							     buf, (size_t)idx);
13ea7f
diff --git a/src/testdir/test_paste.vim b/src/testdir/test_paste.vim
13ea7f
index c94fe7c35..5b8d8a0e3 100644
13ea7f
--- a/src/testdir/test_paste.vim
13ea7f
+++ b/src/testdir/test_paste.vim
13ea7f
@@ -90,6 +90,9 @@ func Test_paste_ex_mode()
13ea7f
   unlet! foo
13ea7f
   call feedkeys("Qlet foo=\"\<Esc>[200~foo\<CR>bar\<Esc>[201~\"\<CR>vi\<CR>", 'xt')
13ea7f
   call assert_equal("foo\rbar", foo)
13ea7f
+
13ea7f
+  " pasting more than 40 bytes
13ea7f
+  exe "norm Q\<PasteStart>0000000000000000000000000000000000000000000000000000000000000000000000\<C-C>"
13ea7f
 endfunc
13ea7f
 
13ea7f
 func Test_paste_onechar()
13ea7f
-- 
13ea7f
2.34.1
13ea7f