patch 8.2.4975: recursive command line loop may cause a crash

Problem:    Recursive command line loop may cause a crash.
Solution:   Limit recursion of getcmdline().

diff --git a/src/ex_getln.c b/src/ex_getln.c
index cbddfea00375f7f418e582f32503b26f33d4e92c..6462b00f732f91c025af3e32b75c6b684cf1f1be 100644 (file)
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -1581,6 +1581,7 @@ getcmdline_int(
     int                indent,         // indent for inside conditionals
     int                clear_ccline)   // clear ccline first
 {
+    static int depth = 0;          // call depth
     int                c;
     int                i;
     int                j;
@@ -1611,6 +1612,9 @@ getcmdline_int(
     int                cmdline_type;
     int                wild_type;
 
+    // one recursion level deeper
+    ++depth;
+
     if (ccline.cmdbuff != NULL)
     {
        // Being called recursively.  Since ccline is global, we need to save
@@ -1641,6 +1645,13 @@ getcmdline_int(
     if (init_ccline(firstc, indent) != OK)
        goto theend;    // out of memory
 
+    if (depth == 50)
+    {
+       // Somehow got into a loop recursively calling getcmdline(), bail out.
+       emsg(_(e_command_too_recursive));
+       goto theend;
+    }
+
     ExpandInit(&xpc);
     ccline.xpc = &xpc;
 
@@ -2576,6 +2587,7 @@ theend:
     {
        char_u *p = ccline.cmdbuff;
 
+       --depth;
        if (did_save_ccline)
            restore_cmdline(&save_ccline);
        else

diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
index e944f8d24d0223c2a9ef609b3e73e852af644e3b..cc7fe54d606734701c1506507d6ff96b5dcecbf2 100644 (file)
--- a/src/testdir/test_cmdline.vim
+++ b/src/testdir/test_cmdline.vim
@@ -3392,4 +3392,16 @@ func Test_screenpos_and_completion()
   call feedkeys(":let a\<C-R>=Check_completion()\<CR>\<Esc>", "xt")
 endfunc
 
+func Test_recursive_register()
+  let @= = ''
+  silent! ?\1ce\12/
+  let caught = 'no'
+  try
+    normal /\12/ 
+  catch /E169:/
+    let caught = 'yes'
+  endtry
+  call assert_equal('yes', caught)
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 98bb40d1166db916a54989ba0d3bf414f1980fa7..8d901e4cc42bc38400d6a4dcaa81f48e65f00420 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -746,6 +746,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4975,
 /**/
     4974,
 /**/