vim-patch:9.0.0024: may access part of typeahead buf that isn't filled

Problem:    May access part of typeahead buf that isn't filled.
Solution:   Check length of typeahead.
af043e12d9
This commit is contained in:
zeertzjq 2022-07-03 05:56:01 +08:00
parent 2b04aaad94
commit 312f1b65c8

View File

@ -1804,7 +1804,8 @@ static int handle_mapping(int *keylenp, bool *timedout, int *mapdepth)
bool is_plug_map = false;
// If typehead starts with <Plug> then remap, even for a "noremap" mapping.
if (typebuf.tb_buf[typebuf.tb_off] == K_SPECIAL
if (typebuf.tb_len >= 3
&& typebuf.tb_buf[typebuf.tb_off] == K_SPECIAL
&& typebuf.tb_buf[typebuf.tb_off + 1] == KS_EXTRA
&& typebuf.tb_buf[typebuf.tb_off + 2] == KE_PLUG) {
is_plug_map = true;