aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-10-15 07:14:09 -04:00
Code Activity

patch 9.0.1477: crash when recovering from corrupted swap file

Browse Source 
Problem:    Crash when recovering from corrupted swap file.
Solution:   Check for a valid page count. (closes #12275)
This commit is contained in:
Bram Moolenaar
2023-04-22 21:14:26 +01:00
parent e7f05a8780
commit b67ba03d3e
5 changed files with 41 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/memline.c
View File

@@ -98,6 +98,9 @@ struct pointer_block
// followed by empty space until end of page
};
// Value for pb_count_max.
#define PB_COUNT_MAX(mfp) (short_u)(((mfp)->mf_page_size - offsetof(PTR_BL, pb_pointer)) / sizeof(PTR_EN))
/*
* A data block is a leaf in the tree.
*
@@ -1525,6 +1528,20 @@ ml_recover(int checkext)
pp = (PTR_BL *)(hp->bh_data);
if (pp->pb_id == PTR_ID) // it is a pointer block
{
int ptr_block_error = FALSE;
if (pp->pb_count_max != PB_COUNT_MAX(mfp))
{
ptr_block_error = TRUE;
pp->pb_count_max = PB_COUNT_MAX(mfp);
}
if (pp->pb_count > pp->pb_count_max)
{
ptr_block_error = TRUE;
pp->pb_count = pp->pb_count_max;
}
if (ptr_block_error)
emsg(_(e_warning_pointer_block_corrupted));
// check line count when using pointer block first time
if (idx == 0 && line_count != 0)
{
@@ -4162,9 +4179,7 @@ ml_new_ptr(memfile_T *mfp)
pp = (PTR_BL *)(hp->bh_data);
pp->pb_id = PTR_ID;
pp->pb_count = 0;
pp->pb_count_max =
(short_u)((mfp->mf_page_size - offsetof(PTR_BL, pb_pointer))
/ sizeof(PTR_EN));
pp->pb_count_max = PB_COUNT_MAX(mfp);
return hp;
}