diff options
| author | Bram Moolenaar <Bram@vim.org> | 2017-02-26 15:27:23 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2017-02-26 15:27:23 +0100 |
| commit | 6d3c8586fc81b022e9f06c611b9926108fb878c7 (patch) | |
| tree | f8ec58f6b4262885089d4e036eccc181bf854986 | |
| parent | 5074a0e0333eaa6a9f697eb765124ca0e244c89b (diff) | |
| download | vim-git-6d3c8586fc81b022e9f06c611b9926108fb878c7.tar.gz | |
patch 8.0.0376: size computations in spell file reading are offv8.0.0376
Problem: Size computations in spell file reading are not exactly right.
Solution: Make "len" a "long" and check with LONG_MAX.
| -rw-r--r-- | src/spellfile.c | 4 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 4 insertions, 2 deletions
diff --git a/src/spellfile.c b/src/spellfile.c index 8b1a3a633..00ef019a6 100644 --- a/src/spellfile.c +++ b/src/spellfile.c @@ -1585,7 +1585,7 @@ spell_read_tree( int prefixtree, /* TRUE for the prefix tree */ int prefixcnt) /* when "prefixtree" is TRUE: prefix count */ { - int len; + long len; int idx; char_u *bp; idx_T *ip; @@ -1595,7 +1595,7 @@ spell_read_tree( len = get4c(fd); if (len < 0) return SP_TRUNCERROR; - if (len >= 0x3ffffff) + if (len >= LONG_MAX / (long)sizeof(int)) /* Invalid length, multiply with sizeof(int) would overflow. */ return SP_FORMERROR; if (len > 0) diff --git a/src/version.c b/src/version.c index 58ece754d..8d1454197 100644 --- a/src/version.c +++ b/src/version.c @@ -765,6 +765,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 376, +/**/ 375, /**/ 374, |