patch 8.2.4974: ":so" command may read after end of buffer

Problem:    ":so" command may read after end of buffer.
Solution:   Compute length of text properly.

diff --git a/src/scriptfile.c b/src/scriptfile.c
index 03c733d3548991745a079ae147802d4f6447e619..f3a5783db510929386d3dbd80e6d70f7020187e5 100644 (file)
--- a/src/scriptfile.c
+++ b/src/scriptfile.c
@@ -1965,6 +1965,7 @@ get_one_sourceline(source_cookie_T *sp)
                break;
            buf = (char_u *)ga.ga_data;
            buf[ga.ga_len++] = NUL;
+           len = ga.ga_len;
        }
        else
        {
@@ -1972,8 +1973,8 @@ get_one_sourceline(source_cookie_T *sp)
            if (fgets((char *)buf + ga.ga_len, ga.ga_maxlen - ga.ga_len,
                        sp->fp) == NULL)
                break;
+           len = ga.ga_len + (int)STRLEN(buf + ga.ga_len);
        }
-       len = ga.ga_len + (int)STRLEN(buf + ga.ga_len);
 #ifdef USE_CRNL
        // Ignore a trailing CTRL-Z, when in Dos mode.  Only recognize the
        // CTRL-Z by its own, or after a NL.

diff --git a/src/testdir/test_source.vim b/src/testdir/test_source.vim
index 5f45ab413c8d73290cce9c86a9cde9dc28a971f4..4736e93546607e0b0f61f40a43f15e83b355ccdd 100644 (file)
--- a/src/testdir/test_source.vim
+++ b/src/testdir/test_source.vim
@@ -652,6 +652,17 @@ func Test_source_buffer_long_line()
   norm300gr0
   so
   bwipe!
+
+  let lines =<< trim END
+      new
+      norm 10a0000000000ø00000000000
+      norm i0000000000000000000
+      silent! so
+  END
+  call writefile(lines, 'Xtest.vim')
+  source Xtest.vim
+  bwipe!
+  call delete('Xtest.vim')
 endfunc
 
 

diff --git a/src/version.c b/src/version.c
index 68d11a2b0f7f77dfd9bb8bb3f8e9ab1f18b0ccae..98bb40d1166db916a54989ba0d3bf414f1980fa7 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -746,6 +746,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4974,
 /**/
     4973,
 /**/