patch 7.4.736

Problem:    Invalid memory access.
Solution:   Avoid going over the end of a NUL terminated string. (Dominique
            Pelle)

diff --git a/src/regexp.c b/src/regexp.c
index 85e0458de0cd1d5065ada9007861b5247c7ae0ea..4ce37c4268cd8eaeb7da75cad0adc7724860b497 100644 (file)
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -1157,7 +1157,7 @@ get_coll_element(pp)
     int                l = 1;
     char_u     *p = *pp;
 
-    if (p[1] == '.')
+    if (p[0] != NUL && p[1] == '.')
     {
 #ifdef FEAT_MBYTE
        if (has_mbyte)
@@ -1228,8 +1228,9 @@ skip_anyof(p)
        {
            if (get_char_class(&p) == CLASS_NONE
                    && get_equi_class(&p) == 0
-                   && get_coll_element(&p) == 0)
-               ++p; /* It was not a class name */
+                   && get_coll_element(&p) == 0
+                   && *p != NUL)
+               ++p; /* it is not a class name and not NUL */
        }
        else
            ++p;
@@ -3156,7 +3157,7 @@ peekchr()
                    /*
                     * META contains everything that may be magic sometimes,
                     * except ^ and $ ("\^" and "\$" are only magic after
-                    * "\v").  We now fetch the next character and toggle its
+                    * "\V").  We now fetch the next character and toggle its
                     * magicness.  Therefore, \ is so meta-magic that it is
                     * not in META.
                     */

diff --git a/src/version.c b/src/version.c
index f474f068baa7c9dda289ce2328939a5af4794bcd..e1ee8c23ae3a03afffd4e9cc7ba282e2dcc84707 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -741,6 +741,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    736,
 /**/
     735,
 /**/