Merge #6958 from ZyX-I/fix-6957

src/nvim/shada.c

@@ -3413,8 +3413,16 @@ shada_read_next_item_start:
     return mru_ret;
   }
 
-  const size_t length = (size_t) length_u64;
+  if (length_u64 > PTRDIFF_MAX) {
-  entry->timestamp = (Timestamp) timestamp_u64;
+    emsgf(_(RCERR "Error while reading ShaDa file: "
+            "there is an item at position %" PRIu64 " "
+            "that is stated to be too long"),
+          initial_fpos);
+    return kSDReadStatusNotShaDa;
+  }
+
+  const size_t length = (size_t)length_u64;
+  entry->timestamp = (Timestamp)timestamp_u64;
 
   if (type_u64 == 0) {
     // kSDItemUnknown cannot possibly pass that far because it is -1 and that

test/functional/helpers.lua

@@ -319,7 +319,14 @@ end
 -- Dedent the given text and write it to the file name.
 local function write_file(name, text, dont_dedent)
   local file = io.open(name, 'w')
-  if not dont_dedent then
+  if type(text) == 'table' then
+    -- Byte blob
+    local bytes = text
+    text = ''
+    for _, char in ipairs(bytes) do
+      text = ('%s%c'):format(text, char)
+    end
+  elseif not dont_dedent then
     text = dedent(text)
   end
   file:write(text)

test/functional/shada/errors_spec.lua

@@ -510,4 +510,22 @@ $
        .. '\nE574: Failed to write variable L',
        redir_exec('wshada'))
   end)
+
+  it('errors with too large items', function()
+    wshada({
+        1, 206,  70,  90,  31, 179,  86, 133, 169, 103, 101, 110, 101, 114,  97,
+      116, 111, 114, 196,   4, 145, 145, 145, 145, 145, 145,  96,  96,  96,  96,
+       96,  96,  96,  96,  96,  96,  96,  96,  96,  96,  96,  96,  96,  96,  96,
+       96,  96, 145, 145, 145, 145, 111, 110, 196,  25,  78,  86,  73,  77,  32,
+      118,   1,  46,  50,  46,  48,  45,  51,  48,  51,  45, 103,  98,  54,  55,
+       52, 102, 100,  50,  99, 169, 109,  97, 120,  95, 107,  98, 121, 116, 101,
+       10, 207, 207, 207, 207, 207, 207, 207, 207, 207, 207, 207, 207, 207, 207,
+      207, 207, 207, 207, 207, 207, 207, 207,  16,   8, 206,  89,  90,  30, 253,
+       35, 129, 161, 102, 196,  30,  47, 100, 101, 118,  47, 115, 104, 109,  47,
+      102, 117, 122, 122, 105, 110, 103,  45, 110, 118, 105, 109,  45, 115, 104,
+       97, 100,  97,  47, 108, 115,   2, 206,  89,  90,  30, 251,  13, 130, 162,
+      115, 112, 196,   3, 102, 111, 111, 162, 115,  99, 195,   3, 146,  10,   0,
+    })
+    eq('Vim(rshada):E576: Error while reading ShaDa file: there is an item at position 93 that is stated to be too long', exc_exec(sdrcmd()))
+  end)
 end)