From 2b9ee872ded554e40d67d173206498171681a089 Mon Sep 17 00:00:00 2001 From: Eric Roshan-Eisner Date: Sat, 25 May 2024 21:44:33 -0700 Subject: [PATCH] vi: handle invalid `:g` arguments without buffer overflow. Replace goto with if block to make variable lifetimes clearer. --- toys/pending/vi.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/toys/pending/vi.c b/toys/pending/vi.c index f1b8bff7..2283edb1 100644 --- a/toys/pending/vi.c +++ b/toys/pending/vi.c @@ -1385,23 +1385,23 @@ static int run_ex_cmd(char *cmd) else if (cmd[1] == 'g' || cmd[1] == 'v') { char *rgx = xmalloc(strlen(cmd)); int el = get_endline(), ln = 0, vorg = (cmd[1] == 'v' ? REG_NOMATCH : 0); - regex_t rgxc; - - if (!sscanf(cmd+2, "/%[^/]/%[^\ng]", rgx, cmd+1) || - regcomp(&rgxc, rgx, 0)) goto gcleanup; - - cmd[0] = ':'; + if (sscanf(cmd+2, "/%[^/]/%[^\ng]", rgx, cmd+1) == 2) { + regex_t rgxc; + if (!regcomp(&rgxc, rgx, 0)) { + cmd[0] = ':'; + + for (; ln < el; ln++) { + run_vi_cmd("yy"); + if (regexec(&rgxc, TT.yank.data, 0, 0, 0) == vorg) run_ex_cmd(cmd); + cur_down(1, 1, 0); + } - for (; ln < el; ln++) { - run_vi_cmd("yy"); - if (regexec(&rgxc, TT.yank.data, 0, 0, 0) == vorg) run_ex_cmd(cmd); - cur_down(1, 1, 0); + // Reset Frame + TT.vi_mov_flag |= 0x30000000; + } + regfree(&rgxc); } - - // Reset Frame - TT.vi_mov_flag |= 0x30000000; -gcleanup: - regfree(&rgxc); free(rgx); + free(rgx); } // Line Ranges -- 2.39.2