neovim

commit a7d100f052b45a106d1385ed419509c047c12431
parent 49fbcb5b8239df9d032e01d54c7f50ffea5e7e3f
Author: zeertzjq <zeertzjq@outlook.com>
Date:   Sun, 30 Oct 2022 06:49:39 +0800

fix: avoid unsigned overflow in home_replace() (#20854)


Diffstat:
M
src/nvim/os/env.c
 | 
6
++++++
M
test/functional/editor/tabpage_spec.lua
 | 
6
++++++

2 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/src/nvim/os/env.c b/src/nvim/os/env.c
@@ -1119,10 +1119,16 @@ size_t home_replace(const buf_T *const buf, const char *src, char *const dst, si
       len = envlen;
     }
 
+    if (dstlen == 0) {
+      break;  // Avoid overflowing below.
+    }
     // if (!one) skip to separator: space or comma.
     while (*src && (one || (*src != ',' && *src != ' ')) && --dstlen > 0) {
       *dst_p++ = *src++;
     }
+    if (dstlen == 0) {
+      break;  // Avoid overflowing below.
+    }
     // Skip separator.
     while ((*src == ' ' || *src == ',') && --dstlen > 0) {
       *dst_p++ = *src++;
diff --git a/test/functional/editor/tabpage_spec.lua b/test/functional/editor/tabpage_spec.lua
@@ -144,4 +144,10 @@ describe('tabpage', function()
     command('     silent      :keepalt   :: :::    silent!    -2    tabmove')
     eq(1, funcs.nvim_tabpage_get_number(0))
   end)
+
+  it(':tabs does not overflow IObuff with long path with comma #20850', function()
+    meths.buf_set_name(0, ('x'):rep(1024) .. ',' .. ('x'):rep(1024))
+    command('tabs')
+    assert_alive()
+  end)
 end)