patch 8.2.4218: illegal memory access with bracketed paste in Ex mode

Problem:    Illegal memory access with bracketed paste in Ex mode.
Solution:   Reserve space for the trailing NUL.

diff --git a/src/edit.c b/src/edit.c
index ee3caf0dad50057485b98b7638eea8550b3a6ebf..2b5301100ddbf2fd9b44cfa49c9e1e028b41a7c5 100644 (file)
--- a/src/edit.c
+++ b/src/edit.c
@@ -4452,7 +4452,8 @@ bracketed_paste(paste_mode_T mode, int drop, garray_T *gap)
                    break;
 
                case PASTE_EX:
-                   if (gap != NULL && ga_grow(gap, idx) == OK)
+                   // add one for the NUL that is going to be appended
+                   if (gap != NULL && ga_grow(gap, idx + 1) == OK)
                    {
                        mch_memmove((char *)gap->ga_data + gap->ga_len,
                                                             buf, (size_t)idx);

diff --git a/src/testdir/test_paste.vim b/src/testdir/test_paste.vim
index c94fe7c357edc62371e4aa3d4edb51db7c7f49d9..5b8d8a0e3e2dba9642b16e4e6be34c36fa9af6fc 100644 (file)
--- a/src/testdir/test_paste.vim
+++ b/src/testdir/test_paste.vim
@@ -90,6 +90,9 @@ func Test_paste_ex_mode()
   unlet! foo
   call feedkeys("Qlet foo=\"\<Esc>[200~foo\<CR>bar\<Esc>[201~\"\<CR>vi\<CR>", 'xt')
   call assert_equal("foo\rbar", foo)
+
+  " pasting more than 40 bytes
+  exe "norm Q\<PasteStart>0000000000000000000000000000000000000000000000000000000000000000000000\<C-C>"
 endfunc
 
 func Test_paste_onechar()

diff --git a/src/version.c b/src/version.c
index 6685b554f537ebd3a21954eedd10f783a7d72379..9dcf34928f8def6287afaf0346fa4b66d497c97d 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4218,
 /**/
     4217,
 /**/