patch 9.1.1242: Crash when evaluating variable name
Commit:
https://github.com/vim/vim/commit/06774a271a7d728f188175340154361255d6b0a4
Author: Christian Brabandt <c...@256bit.org>
Date: Wed Mar 26 19:25:57 2025 +0100
patch 9.1.1242: Crash when evaluating variable name
Problem: Crash when evaluating variable name (after v9.1.0870)
Solution: calculate the strlen() directly instead of pointer
arithmetics, fix missing assignment to lp->ll_name_end in
get_lval() (zeertzjq)
closes: #16972
fixes: vim-airline/vim-airline#2710
related: #16066
Co-authored-by: zeertzjq <zeert...@outlook.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>
diff --git a/src/eval.c b/src/eval.c
index c2856fe72..923e7a43d 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -2163,6 +2163,8 @@ get_lval(
}
}
lp->ll_name = lp->ll_exp_name;
+ if (lp->ll_name != NULL)
+ lp->ll_name_end = lp->ll_name + STRLEN(lp->ll_name);
}
else
{
@@ -2373,7 +2375,7 @@ set_var_lval(
// handle +=, -=, *=, /=, %= and .=
di = NULL;
- if (eval_variable(lp->ll_name, (int)(lp->ll_name_end - lp->ll_name),
+ if (eval_variable(lp->ll_name, (int)STRLEN(lp->ll_name),
lp->ll_sid, &tv, &di, EVAL_VAR_VERBOSE) == OK)
{
if (di != NULL && check_typval_is_value(&di->di_tv) == FAIL)
diff --git a/src/version.c b/src/version.c
index 63214b6a2..db9588e6c 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 1242,
/**/
1241,
/**/
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to vim_dev+unsubscr...@googlegroups.com.
To view this discussion visit
https://groups.google.com/d/msgid/vim_dev/E1txVVq-00HGKc-Qj%40256bit.org.
