[vim/vim] fnamemodify: ":8" followed by ":t" uses the wrong name (PR #20903)

```
Problem:  On MS-Windows using ":8" with ":t", ":e" or ":r" in one
          fnamemodify() gives a wrong result or an out of memory error.
Solution: Recompute the tail after ":8" replaced the name.
```

---

fnamemodify('c:/temp/longfilename.txt', ':p:8:t') gives

    E342: Out of memory!  (allocating 4294966969 bytes)

on a volume where 8.3 short names are created.

modify_fname() computes "tail" before handling ":8".  That code replaces
the name with the short name in another buffer, so ":t" then subtracts a
pointer into the old buffer:

    *fnamelen -= tail - *fnamep;
    *fnamep = tail;

The length underflows and the name points into the freed buffer.  ":e" and
":r" use "tail" as well.

Found by the CI of #20899, where a test used ":p:8:t".
You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/20903

-- Commit Summary --

  * fnamemodify: ":8" followed by ":t" uses the wrong name

-- File Changes --

    M src/filepath.c (4)
    M src/testdir/test_shortpathname.vim (20)

-- Patch Links --

https://github.com/vim/vim/pull/20903.patch
https://github.com/vim/vim/pull/20903.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/vim/vim/pull/20903
You are receiving this because you are subscribed to this thread.

Message ID: <vim/vim/pull/[email protected]>

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups "vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/vim_dev/vim/vim/pull/20903%40github.com.