aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-28 04:24:06 -04:00
Code Activity

patch 8.0.0376: size computations in spell file reading are off

Browse Source 
Problem:    Size computations in spell file reading are not exactly right.
Solution:   Make "len" a "long" and check with LONG_MAX.
This commit is contained in:
Bram Moolenaar
2017-02-26 15:27:23 +01:00
parent 5074a0e033
commit 6d3c8586fc
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/spellfile.c
View File

@@ -1585,7 +1585,7 @@ spell_read_tree(
int prefixtree, /* TRUE for the prefix tree */ int prefixtree, /* TRUE for the prefix tree */
int prefixcnt) /* when "prefixtree" is TRUE: prefix count */ int prefixcnt) /* when "prefixtree" is TRUE: prefix count */
{ {
int len; long len;
int idx; int idx;
char_u *bp; char_u *bp;
idx_T *ip; idx_T *ip;
@@ -1595,7 +1595,7 @@ spell_read_tree(
len = get4c(fd); len = get4c(fd);
if (len < 0) if (len < 0)
return SP_TRUNCERROR; return SP_TRUNCERROR;
if (len >= 0x3ffffff) if (len >= LONG_MAX / (long)sizeof(int))
/* Invalid length, multiply with sizeof(int) would overflow. */ /* Invalid length, multiply with sizeof(int) would overflow. */
return SP_FORMERROR; return SP_FORMERROR;
if (len > 0) if (len > 0)

2
src/version.c
View File

@@ -764,6 +764,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
376,
/**/ /**/
375, 375,
/**/ /**/