Skip to content

Commit 6d3c858

Browse files
committed
patch 8.0.0376: size computations in spell file reading are off
Problem: Size computations in spell file reading are not exactly right. Solution: Make "len" a "long" and check with LONG_MAX.
1 parent 5074a0e commit 6d3c858

File tree

2 files changed

+4
-2
lines changed

2 files changed

+4
-2
lines changed

src/spellfile.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1585,7 +1585,7 @@ spell_read_tree(
15851585
int prefixtree, /* TRUE for the prefix tree */
15861586
int prefixcnt) /* when "prefixtree" is TRUE: prefix count */
15871587
{
1588-
int len;
1588+
long len;
15891589
int idx;
15901590
char_u *bp;
15911591
idx_T *ip;
@@ -1595,7 +1595,7 @@ spell_read_tree(
15951595
len = get4c(fd);
15961596
if (len < 0)
15971597
return SP_TRUNCERROR;
1598-
if (len >= 0x3ffffff)
1598+
if (len >= LONG_MAX / (long)sizeof(int))
15991599
/* Invalid length, multiply with sizeof(int) would overflow. */
16001600
return SP_FORMERROR;
16011601
if (len > 0)

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -764,6 +764,8 @@ static char *(features[]) =
764764

765765
static int included_patches[] =
766766
{ /* Add new patch number below this line */
767+
/**/
768+
376,
767769
/**/
768770
375,
769771
/**/

0 commit comments

Comments
 (0)