patch 9.0.0104: going beyond allocated memory when evaluating string constant

Problem:    Going beyond allocated memory when evaluating string constant.
Solution:   Properly skip over <Key> form.

diff --git a/src/testdir/test_eval_stuff.vim b/src/testdir/test_eval_stuff.vim
index 3c168f2f59b58599dd68c262a83e472838c08c43..c63082e8e8b6dcc823d2fee3f3054ee363e8f11e 100644 (file)
--- a/src/testdir/test_eval_stuff.vim
+++ b/src/testdir/test_eval_stuff.vim
@@ -617,4 +617,9 @@ func Test_modified_char_no_escape_special()
   nunmap <M-…>
 endfunc
 
+func Test_eval_string_in_special_key()
+  " this was using the '{' inside <> as the start of an interpolated string
+  silent! echo 0{1-$"\<S--{>\17n|nö%\0
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/typval.c b/src/typval.c
index a266330622c8233c0e1fa6aa711d3a2428576c90..8b69adfcc8b8ef798908d38dbf78c8996c9aa4f0 100644 (file)
--- a/src/typval.c
+++ b/src/typval.c
@@ -2090,7 +2090,19 @@ eval_string(char_u **arg, typval_T *rettv, int evaluate, int interpolate)
            // to 9 characters (6 for the char and 3 for a modifier):
            // reserve space for 5 extra.
            if (*p == '<')
+           {
+               int             modifiers = 0;
+               int             flags = FSK_KEYCODE | FSK_IN_STRING;
+
                extra += 5;
+
+               // Skip to the '>' to avoid using '{' inside for string
+               // interpolation.
+               if (p[1] != '*')
+                   flags |= FSK_SIMPLIFY;
+               if (find_special_key(&p, &modifiers, flags, NULL) != 0)
+                   --p;  // leave "p" on the ">"
+           }
        }
        else if (interpolate && (*p == '{' || *p == '}'))
        {

diff --git a/src/version.c b/src/version.c
index 9f6b19499ea0ce90f4d2957401234bb8958bc07c..8c55a62e9d2cc5a459484618c7ae793c97a773dd 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    104,
 /**/
     103,
 /**/