From 0d5a12ea041c112b06b1aafde38846ae4cff8f4c Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Sun, 14 Nov 2021 14:05:18 +0000 Subject: [PATCH] patch 8.2.3595: check for signed overflow might not work everywhere Problem: Check for signed overflow might not work everywhere. Solution: Limit to 32 bit int. (closes #9043, closes #9067) --- src/getchar.c | 8 ++++++-- src/version.c | 2 ++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/src/getchar.c b/src/getchar.c index f2f38853b..a6644d8ef 100644 --- a/src/getchar.c +++ b/src/getchar.c @@ -1001,6 +1001,8 @@ ins_typebuf( } else { + int extra; + /* * Need to allocate a new buffer. * In typebuf.tb_buf there must always be room for 3 * (MAXMAPLEN + 4) @@ -1008,13 +1010,15 @@ ins_typebuf( * often. */ newoff = MAXMAPLEN + 4; - newlen = typebuf.tb_len + addlen + newoff + 4 * (MAXMAPLEN + 4); - if (newlen < 0) // string is getting too long + extra = addlen + newoff + 4 * (MAXMAPLEN + 4); + if (typebuf.tb_len > 2147483647 - extra) { + // string is getting too long for a 32 bit int emsg(_(e_toocompl)); // also calls flush_buffers setcursor(); return FAIL; } + newlen = typebuf.tb_len + extra; s1 = alloc(newlen); if (s1 == NULL) // out of memory return FAIL; diff --git a/src/version.c b/src/version.c index 0374843d9..19014e67a 100644 --- a/src/version.c +++ b/src/version.c @@ -757,6 +757,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 3595, /**/ 3594, /**/ -- 2.40.0