updated for version 7.4.465

Problem:    Crash when expanding a very long string.
Solution:   Use wsncpy() instead of wcscpy(). (Ken Takata)

diff --git a/src/os_win32.c b/src/os_win32.c
index 21c3ee9f4ea90f2f94c99a77b13fe4da08dea3b2..eb66ed2d2bd0cb2a9648fc9354ddb5e9ceb6c40b 100644 (file)
--- a/src/os_win32.c
+++ b/src/os_win32.c
@@ -2775,9 +2775,10 @@ fname_case(
        if (p != NULL)
        {
            char_u      *q;
-           WCHAR       buf[_MAX_PATH + 2];
+           WCHAR       buf[_MAX_PATH + 1];
 
-           wcscpy(buf, p);
+           wcsncpy(buf, p, _MAX_PATH);
+           buf[_MAX_PATH] = L'\0';
            vim_free(p);
 
            if (fname_casew(buf, (len > 0) ? _MAX_PATH : 0) == OK)

diff --git a/src/version.c b/src/version.c
index dc9d25d58969819b03673db9add5b66adf7834cf..c502cdc4b86bbdbb24a811a6726571445b87af74 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -741,6 +741,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    465,
 /**/
     464,
 /**/