updated for version 7.3.371

Problem:    Crash in autocomplete. (Greg Weber)
Solution:   Check not going over allocated buffer size.

diff --git a/src/misc2.c b/src/misc2.c
index 20ee1701b99cf6fce606f57abe95199b484d9de5..784e4889f1e097505ec92865567c7152d0ac2c8d 100644 (file)
--- a/src/misc2.c
+++ b/src/misc2.c
@@ -4293,6 +4293,8 @@ static ff_stack_T *ff_create_stack_element __ARGS((char_u *, int, int));
 static int ff_path_in_stoplist __ARGS((char_u *, int, char_u **));
 #endif
 
+static char_u e_pathtoolong[] = N_("E854: path too long for completion");
+
 #if 0
 /*
  * if someone likes findfirst/findnext, here are the functions
@@ -4589,6 +4591,11 @@ vim_findfile_init(path, filename, stopdirs, level, free_visited, find_what,
        len = 0;
        while (*wc_part != NUL)
        {
+           if (len + 5 >= MAXPATHL)
+           {
+               EMSG(_(e_pathtoolong));
+               break;
+           }
            if (STRNCMP(wc_part, "**", 2) == 0)
            {
                ff_expand_buffer[len++] = *wc_part++;
@@ -4634,6 +4641,12 @@ vim_findfile_init(path, filename, stopdirs, level, free_visited, find_what,
     }
 
     /* create an absolute path */
+    if (STRLEN(search_ctx->ffsc_start_dir)
+                         + STRLEN(search_ctx->ffsc_fix_path) + 3 >= MAXPATHL)
+    {
+       EMSG(_(e_pathtoolong));
+       goto error_return;
+    }
     STRCPY(ff_expand_buffer, search_ctx->ffsc_start_dir);
     add_pathsep(ff_expand_buffer);
     STRCAT(ff_expand_buffer, search_ctx->ffsc_fix_path);

diff --git a/src/version.c b/src/version.c
index 145a1dcba9607843bbf3197f633835e22ee0f1ac..767103b9519a06d5f833070e816ed53336e29f2a 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -714,6 +714,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    371,
 /**/
     370,
 /**/