File _service:tar_scm:backport-CVE-2023-0433.patch of Package vim

File _service:tar_scm:backport-CVE-2023-0433.patch of Package vim (Revision 33cc0ca67c1cc9d197ffbbf28e64748a)

Currently displaying revision 33cc0ca67c1cc9d197ffbbf28e64748a , Show latest

From 11977f917506d950b7e0cae558bd9189260b253b Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 21 Jan 2023 13:09:19 +0000
Subject: [PATCH] patch 9.0.1225: reading past the end of a line when
 formatting text

Problem:    Reading past the end of a line when formatting text.
Solution:   Check for not going over the end of the line.
---
 src/textformat.c | 10 +++++++++-
 1 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/textformat.c b/src/textformat.c
index 6a93890bd2c4..7ebbc8849a45 100644
--- a/src/textformat.c
+++ b/src/textformat.c
@@ -540,6 +540,9 @@ same_leader(
     if (leader1_len == 0)
 	return (leader2_len == 0);
 
+    char_u  *lnum_line = NULL;
+    int	    line_len = 0;
+
     // If first leader has 'f' flag, the lines can be joined only if the
     // second line does not have a leader.
     // If first leader has 'e' flag, the lines can never be joined.
@@ -555,7 +558,12 @@ same_leader(
 		return FALSE;
 	    if (*p == COM_START)
 	    {
-		if (*(ml_get(lnum) + leader1_len) == NUL)
+		if (lnum_line == NULL)
+		{
+		    lnum_line = ml_get(lnum);
+		    line_len = (int)STRLEN(lnum_line);
+		}
+		if (line_len <= leader1_len)
 		    return FALSE;
 		if (leader2_flags == NULL || leader2_len == 0)
 		    return FALSE;