From ab350f89f9646e07aefe16a32ba3ddb847496b4a Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Thu, 28 Feb 2019 06:25:00 +0100
Subject: [PATCH] patch 8.1.0985: crash with large number in regexp

Problem:    Crash with large number in regexp. (Kuang-che Wu)
Solution:   Check for long becoming negative int. (closes #)
---
 src/regexp.c                |  4 ++--
 src/testdir/test_search.vim | 25 ++++++++++++++++++++++++-
 src/version.c               |  2 ++
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/src/regexp.c b/src/regexp.c
index 5c06ada1b..d7c577077 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -2228,7 +2228,7 @@ regatom(int *flagp)
 				  default:  i = -1; break;
 			      }
 
-			      if (i < 0)
+			      if (i < 0 || i > INT_MAX)
 				  EMSG2_RET_NULL(
 					_("E678: Invalid character after %s%%[dxouU]"),
 					reg_magic == MAGIC_ALL);
@@ -3293,7 +3293,7 @@ coll_get_char(void)
 	case 'u': nr = gethexchrs(4); break;
 	case 'U': nr = gethexchrs(8); break;
     }
-    if (nr < 0)
+    if (nr < 0 || nr > INT_MAX)
     {
 	/* If getting the number fails be backwards compatible: the character
 	 * is a backslash. */
diff --git a/src/testdir/test_search.vim b/src/testdir/test_search.vim
index 5cf70d4d8..d32369d5a 100644
--- a/src/testdir/test_search.vim
+++ b/src/testdir/test_search.vim
@@ -1212,13 +1212,36 @@ func Test_search_Ctrl_L_combining()
   call Incsearch_cleanup()
 endfunc
 
-func Test_large_hex_chars()
+func Test_large_hex_chars1()
   " This used to cause a crash, the character becomes an NFA state.
   try
     /\%Ufffffc23
   catch
     call assert_match('E678:', v:exception)
   endtry
+  try
+    set re=1
+    /\%Ufffffc23
+  catch
+    call assert_match('E678:', v:exception)
+  endtry
+  set re&
+endfunc
+
+func Test_large_hex_chars2()
+  " This used to cause a crash, the character becomes an NFA state.
+  try
+    /[\Ufffffc1f]
+  catch
+    call assert_match('E486:', v:exception)
+  endtry
+  try
+    set re=1
+    /[\Ufffffc1f]
+  catch
+    call assert_match('E486:', v:exception)
+  endtry
+  set re&
 endfunc
 
 func Test_one_error_msg()
diff --git a/src/version.c b/src/version.c
index 74850a0b3..9b87302cc 100644
--- a/src/version.c
+++ b/src/version.c
@@ -779,6 +779,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    985,
 /**/
     984,
 /**/
-- 
2.50.1