[vim/vim] fnamemodify: ":8" followed by ":t" uses the wrong name (PR #20903)
h_east
Problem: On MS-Windows using ":8" with ":t", ":e" or ":r" in one
fnamemodify() gives a wrong result or an out of memory error.
Solution: Recompute the tail after ":8" replaced the name.
fnamemodify('c:/temp/longfilename.txt', ':p:8:t') gives
E342: Out of memory! (allocating 4294966969 bytes)
on a volume where 8.3 short names are created.
modify_fname() computes "tail" before handling ":8". That code replaces
the name with the short name in another buffer, so ":t" then subtracts a
pointer into the old buffer:
*fnamelen -= tail - *fnamep;
*fnamep = tail;
The length underflows and the name points into the freed buffer. ":e" and
":r" use "tail" as well.
Found by the CI of #20899, where a test used ":p:8:t".
You can view, comment on, or merge this pull request online at:
https://github.com/vim/vim/pull/20903
Commit Summary
- 9d5dd9e fnamemodify: ":8" followed by ":t" uses the wrong name
File Changes
(2 files)
- M src/filepath.c (4)
- M src/testdir/test_shortpathname.vim (20)
Patch Links:
—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.