Hi

This command gives E342 immediately on my laptop:

  $ vim -u NONE -c 'norm o' -c 'norm 66666666666dH'
  Error detected while processing command line:
  E342: Out of memory!  (allocating 16422480584 bytes)
  cannot yank; delete anyway (y/n)?


And the following command makes my laptop freeze
for a couple of minutes (can't even move the mouse)
until vim gets killed:

  $ vim -u NONE -c 'norm o' -c 'norm 999999999999dH'
  Killed

I see that function op_yank() in ops.c is trying to allocate
a very large y_current->y_array array:

2988 y_current->y_array = (char_u**)lalloc_clear((long_u)(sizeof(char_u *) *
2989                                           yanklines), TRUE);

  (gdb) p yanklines
  $9 = 2052810073

Yet the buffer contains only 1 line.

I don't really understand how op_yank() works but it looks
like it should not need to allocate a large amount of memory
to yank lines, when the buffer contains only 1 line.

With gdb inside frame of op_yank(), I see:

  (gdb) p oap->line_count
  $7 = 2052810073
  (gdb) p oap->end.lnum
  $8 = 2

Issue was found with afl-fuzz.

Dominique

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Raspunde prin e-mail lui