diff options
| author | Bram Moolenaar <Bram@vim.org> | 2011-02-01 21:55:01 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2011-02-01 21:55:01 +0100 |
| commit | 1d87f516f2133dfadba1055c3009672ca96b84bf (patch) | |
| tree | 1cc45895b625f8c2798e9c6a806c315ee3f4b7b7 /src/buffer.c | |
| parent | 6145285c905ae9a65cf83473ad490e1b077a8c6f (diff) | |
| download | vim-1d87f516f2133dfadba1055c3009672ca96b84bf.zip | |
updated for version 7.3.112
Problem: Setting 'statusline' to "%!'asdf%' reads uninitialized memory.
Solution: Check for NUL after %.
Diffstat (limited to 'src/buffer.c')
| -rw-r--r-- | src/buffer.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/buffer.c b/src/buffer.c index a7290aebb..e91b7c847 100644 --- a/src/buffer.c +++ b/src/buffer.c @@ -3364,7 +3364,8 @@ free_titles() * or truncated if too long, fillchar is used for all whitespace. */ int -build_stl_str_hl(wp, out, outlen, fmt, use_sandbox, fillchar, maxwidth, hltab, tabtab) +build_stl_str_hl(wp, out, outlen, fmt, use_sandbox, fillchar, + maxwidth, hltab, tabtab) win_T *wp; char_u *out; /* buffer to write into != NameBuff */ size_t outlen; /* length of out[] */ @@ -3474,6 +3475,8 @@ build_stl_str_hl(wp, out, outlen, fmt, use_sandbox, fillchar, maxwidth, hltab, t * Handle one '%' item. */ s++; + if (*s == NUL) /* ignore trailing % */ + break; if (*s == '%') { if (p + 1 >= out + outlen) |