Blame SOURCES/0001-patch-8.2.4218-illegal-memory-access-with-bracketed-.patch

9bb4fd
commit ec45bc7682fd698d8d39f43732129c4d092355f3
9bb4fd
Author: Tomas Korbar <tkorbar@redhat.com>
9bb4fd
Date:   Wed Feb 2 16:30:11 2022 +0100
9bb4fd
9bb4fd
    Fix illegal memory access with bracketed paste in Ex mode
9bb4fd
9bb4fd
diff --git a/src/edit.c b/src/edit.c
9bb4fd
index f29fbc7..57b8dce 100644
9bb4fd
--- a/src/edit.c
9bb4fd
+++ b/src/edit.c
9bb4fd
@@ -9519,27 +9519,33 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
9bb4fd
     int		ret_char = -1;
9bb4fd
     int		save_allow_keys = allow_keys;
9bb4fd
     int		save_paste = p_paste;
9bb4fd
-    int		save_ai = curbuf->b_p_ai;
9bb4fd
 
9bb4fd
-    /* If the end code is too long we can't detect it, read everything. */
9bb4fd
-    if (STRLEN(end) >= NUMBUFLEN)
9bb4fd
+    // If the end code is too long we can't detect it, read everything.
9bb4fd
+    if (end != NULL && STRLEN(end) >= NUMBUFLEN)
9bb4fd
 	end = NULL;
9bb4fd
     ++no_mapping;
9bb4fd
     allow_keys = 0;
9bb4fd
-    p_paste = TRUE;
9bb4fd
-    curbuf->b_p_ai = FALSE;
9bb4fd
+    if (!p_paste)
9bb4fd
+	// Also have the side effects of setting 'paste' to make it work much
9bb4fd
+	// faster.
9bb4fd
+	set_option_value((char_u *)"paste", TRUE, NULL, 0);
9bb4fd
 
9bb4fd
     for (;;)
9bb4fd
     {
9bb4fd
 	/* When the end is not defined read everything. */
9bb4fd
 	if (end == NULL && vpeekc() == NUL)
9bb4fd
 	    break;
9bb4fd
-	c = plain_vgetc();
9bb4fd
-#ifdef FEAT_MBYTE
9bb4fd
+	do
9bb4fd
+	    c = vgetc();
9bb4fd
+	while (c == K_IGNORE || c == K_VER_SCROLLBAR || c == K_HOR_SCROLLBAR);
9bb4fd
+	if (c == NUL || got_int || (ex_normal_busy > 0 && c == Ctrl_C))
9bb4fd
+	    // When CTRL-C was encountered the typeahead will be flushed and we
9bb4fd
+	    // won't get the end sequence.  Except when using ":normal".
9bb4fd
+	    break;
9bb4fd
+
9bb4fd
 	if (has_mbyte)
9bb4fd
 	    idx += (*mb_char2bytes)(c, buf + idx);
9bb4fd
 	else
9bb4fd
-#endif
9bb4fd
 	    buf[idx++] = c;
9bb4fd
 	buf[idx] = NUL;
9bb4fd
 	if (end != NULL && STRNCMP(buf, end, idx) == 0)
9bb4fd
@@ -9557,7 +9563,8 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
9bb4fd
 		    break;
9bb4fd
 
9bb4fd
 		case PASTE_EX:
9bb4fd
-		    if (gap != NULL && ga_grow(gap, idx) == OK)
9bb4fd
+		    // add one for the NUL that is going to be appended
9bb4fd
+		    if (gap != NULL && ga_grow(gap, idx + 1) == OK)
9bb4fd
 		    {
9bb4fd
 			mch_memmove((char *)gap->ga_data + gap->ga_len,
9bb4fd
 							     buf, (size_t)idx);
9bb4fd
@@ -9582,11 +9589,9 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
9bb4fd
 		case PASTE_ONE_CHAR:
9bb4fd
 		    if (ret_char == -1)
9bb4fd
 		    {
9bb4fd
-#ifdef FEAT_MBYTE
9bb4fd
 			if (has_mbyte)
9bb4fd
 			    ret_char = (*mb_ptr2char)(buf);
9bb4fd
 			else
9bb4fd
-#endif
9bb4fd
 			    ret_char = buf[0];
9bb4fd
 		    }
9bb4fd
 		    break;
9bb4fd
@@ -9597,8 +9602,8 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
9bb4fd
 
9bb4fd
     --no_mapping;
9bb4fd
     allow_keys = save_allow_keys;
9bb4fd
-    p_paste = save_paste;
9bb4fd
-    curbuf->b_p_ai = save_ai;
9bb4fd
+    if (!save_paste)
9bb4fd
+	set_option_value((char_u *)"paste", FALSE, NULL, 0);
9bb4fd
 
9bb4fd
     return ret_char;
9bb4fd
 }