mirror of
https://github.com/vim/vim.git
synced 2025-09-28 04:24:06 -04:00
patch 8.0.0376: size computations in spell file reading are off
Problem: Size computations in spell file reading are not exactly right. Solution: Make "len" a "long" and check with LONG_MAX.
This commit is contained in:
@@ -1585,7 +1585,7 @@ spell_read_tree(
|
||||
int prefixtree, /* TRUE for the prefix tree */
|
||||
int prefixcnt) /* when "prefixtree" is TRUE: prefix count */
|
||||
{
|
||||
int len;
|
||||
long len;
|
||||
int idx;
|
||||
char_u *bp;
|
||||
idx_T *ip;
|
||||
@@ -1595,7 +1595,7 @@ spell_read_tree(
|
||||
len = get4c(fd);
|
||||
if (len < 0)
|
||||
return SP_TRUNCERROR;
|
||||
if (len >= 0x3ffffff)
|
||||
if (len >= LONG_MAX / (long)sizeof(int))
|
||||
/* Invalid length, multiply with sizeof(int) would overflow. */
|
||||
return SP_FORMERROR;
|
||||
if (len > 0)
|
||||
|
@@ -764,6 +764,8 @@ static char *(features[]) =
|
||||
|
||||
static int included_patches[] =
|
||||
{ /* Add new patch number below this line */
|
||||
/**/
|
||||
376,
|
||||
/**/
|
||||
375,
|
||||
/**/
|
||||
|
Reference in New Issue
Block a user