From: Christian Brabandt <cb@256bit.org>
Date: Thu, 29 Aug 2024 20:12:05 +0000 (+0200)
Subject: patch 9.1.0703: crash with 2byte encoding and glob2regpat()
X-Git-Tag: v9.1.0703^0
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c9bfed2fda8c23cc02325b1a7a6d84dc62bbea4b;p=thirdparty%2Fvim.git

patch 9.1.0703: crash with 2byte encoding and glob2regpat()

Problem:  possible crash with 2-byte encoding and glob2regpat()
          (after v9.1.0700, v9.1.0702)
Solution: include both bytes for a multi-byte character for an
          escaped character

closes: #15590

Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/fileio.c b/src/fileio.c
index d27a1727ed..5fee4e0be9 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -5714,6 +5714,8 @@ file_pat_to_reg_pat(
 				)
 			    *allow_dirs = TRUE;
 			reg_pat[i++] = '\\';
+			if (enc_dbcs != 0 && (*mb_ptr2len)(p) > 1)
+			    reg_pat[i++] = *p++;
 			reg_pat[i++] = *p;
 		    }
 		break;
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index d6975931b3..bfd04ff10f 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -222,11 +222,11 @@ func Test_crash1_3()
   call term_sendkeys(buf, args)
   call TermWait(buf, 150)
 
-  " let file = 'crash/heap_overflow_glob2regpat'
-  " let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
-  " let args = printf(cmn_args, vim, file)
-  " call term_sendkeys(buf, args)
-  " call TermWait(buf, 50)
+  let file = 'crash/heap_overflow_glob2regpat'
+  let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
+  let args = printf(cmn_args, vim, file)
+  call term_sendkeys(buf, args)
+  call TermWait(buf, 50)
 
   let file = 'crash/nullptr_regexp_nfa'
   let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
diff --git a/src/version.c b/src/version.c
index c3e510a92a..3c30cbdb44 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    703,
 /**/
     702,
 /**/