diff options
| author | Bram Moolenaar <Bram@vim.org> | 2017-02-09 21:07:12 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2017-02-09 21:07:12 +0100 |
| commit | 399c297aa93afe2c0a39e2a1b3f972aebba44c9d (patch) | |
| tree | f9175f98e1893debeaaaa62f4bd11be1c3baa7e4 /src/spellfile.c | |
| parent | 8cc2a9c062fa38e133a62778518f769a423a2526 (diff) | |
| download | vim-399c297aa93afe2c0a39e2a1b3f972aebba44c9d.zip | |
patch 8.0.0322: possible overflow with corrupted spell file
Problem: Possible overflow with spell file where the tree length is
corrupted.
Solution: Check for an invalid length (suggested by shqking)
Diffstat (limited to 'src/spellfile.c')
| -rw-r--r-- | src/spellfile.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/spellfile.c b/src/spellfile.c index c7d87c6c7..8b1a3a633 100644 --- a/src/spellfile.c +++ b/src/spellfile.c @@ -1595,6 +1595,9 @@ spell_read_tree( len = get4c(fd); if (len < 0) return SP_TRUNCERROR; + if (len >= 0x3ffffff) + /* Invalid length, multiply with sizeof(int) would overflow. */ + return SP_FORMERROR; if (len > 0) { /* Allocate the byte array. */ |