commit d43f0951bca162d4491d57df9277b5dbc462944f
author Bram Moolenaar <Bram@vim.org> Thu Aug 27 22:30:47 2015 +0200
committer Bram Moolenaar <Bram@vim.org> Thu Aug 27 22:30:47 2015 +0200
tree 991fb61c507ad6a26a63b735118c07ca442e93f4
parent cdf0442d009ea97fad06d72231f7de309c75205a

patch 7.4.843
Problem:    Still possible to go beyond the end of a string.
Solution:   Check for NUL also in second string. (Dominique Pelle)

src/misc2.c

diff --git a/src/misc2.c b/src/misc2.c
index a4a65d6..379916b 100644
--- a/src/misc2.c
+++ b/src/misc2.c
@@ -5059,6 +5059,8 @@
     char_u	*s2;
 {
     int		i, j;
+    int		c1 = NUL;
+    int		c2 = NUL;
     int		prev1 = NUL;
     int		prev2 = NUL;
 
@@ -5068,21 +5070,21 @@
     if (s1 == NULL || s2 == NULL)
 	return FALSE;
 
-    for (i = 0, j = 0; s1[i] != NUL;)
+    for (i = 0, j = 0; s1[i] != NUL && s2[j] != NUL;)
     {
-	int c1 = PTR2CHAR(s1 + i);
-	int c2 = PTR2CHAR(s2 + j);
+	c1 = PTR2CHAR(s1 + i);
+	c2 = PTR2CHAR(s2 + j);
 
 	if ((p_fic ? MB_TOLOWER(c1) != MB_TOLOWER(c2) : c1 != c2)
 		&& (prev1 != '*' || prev2 != '*'))
-	    return FAIL;
+	    return FALSE;
 	prev2 = prev1;
 	prev1 = c1;
 
         i += MB_PTR2LEN(s1 + i);
         j += MB_PTR2LEN(s2 + j);
     }
-    return TRUE;
+    return c1 == c2;
 }
 #endif
 

src/version.c

diff --git a/src/version.c b/src/version.c
index 37df414..215e03b 100644
--- a/src/version.c
+++ b/src/version.c
@@ -742,6 +742,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    843,
+/**/
     842,
 /**/
     841,