To: vim_dev@googlegroups.com
Subject: Patch 9.0.0024
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 9.0.0024
Problem:    May access part of typeahead buf that isn't filled.
Solution:   Check length of typeahead.
Files:      src/getchar.c


*** ../vim-9.0.0023/src/getchar.c	2022-06-10 15:19:51.000000000 +0100
--- src/getchar.c	2022-07-02 12:06:40.083045954 +0100
***************
*** 2437,2443 ****
      int		is_plug_map = FALSE;
  
      // If typehead starts with <Plug> then remap, even for a "noremap" mapping.
!     if (typebuf.tb_buf[typebuf.tb_off] == K_SPECIAL
  	    && typebuf.tb_buf[typebuf.tb_off + 1] == KS_EXTRA
  	    && typebuf.tb_buf[typebuf.tb_off + 2] == KE_PLUG)
  	is_plug_map = TRUE;
--- 2437,2444 ----
      int		is_plug_map = FALSE;
  
      // If typehead starts with <Plug> then remap, even for a "noremap" mapping.
!     if (typebuf.tb_len >= 3
! 	    && typebuf.tb_buf[typebuf.tb_off] == K_SPECIAL
  	    && typebuf.tb_buf[typebuf.tb_off + 1] == KS_EXTRA
  	    && typebuf.tb_buf[typebuf.tb_off + 2] == KE_PLUG)
  	is_plug_map = TRUE;
*** ../vim-9.0.0023/src/version.c	2022-07-02 11:40:36.911418191 +0100
--- src/version.c	2022-07-02 12:07:53.442155749 +0100
***************
*** 737,738 ****
--- 737,740 ----
  {   /* Add new patch number below this line */
+ /**/
+     24,
  /**/

-- 
Everyone has a photographic memory. Most don't have a memory card.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///                                                                      \\\
\\\        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///