IntenseFinance/neovim
3
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-02-25 18:55:25 -06:00
Code Issues Packages Projects Releases Wiki Activity

coverity/13688: Check for NUL bytes in salfrom

Browse Source
This commit is contained in:
ZyX 2017-04-09 22:16:26 +03:00
parent ecce981dba
commit 8f75b67c07
2 changed files with 26 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/nvim/spellfile.c
View File

@ -1157,8 +1157,8 @@ static int read_sal_section(FILE *fd, slang_T *slang)
if (i < ccnt) if (i < ccnt)
// store the char we got while checking for end of sm_lead // store the char we got while checking for end of sm_lead
*p++ = c; *p++ = c;
for (++i; i < ccnt; ++i) SPELL_READ_NONNUL_BYTES((char *)p, (size_t)ccnt, fd); // <salfrom>
*p++ = getc(fd); // <salfrom> p += ccnt;
*p++ = NUL; *p++ = NUL;
// <saltolen> <salto> // <saltolen> <salto>

27
test/functional/spell/spellfile_spec.lua
View File

@ -27,7 +27,6 @@ describe('spellfile', function()
-- ┌ Section identifier (#SN_PREFCOND) -- ┌ Section identifier (#SN_PREFCOND)
-- │ ┌ Section flags (#SNF_REQUIRED or zero) -- │ ┌ Section flags (#SNF_REQUIRED or zero)
-- │ │ ┌ Section length (4 bytes, MSB first) -- │ │ ┌ Section length (4 bytes, MSB first)
-- │ │ │
spellheader .. '\003\001\000\000\000\003' spellheader .. '\003\001\000\000\000\003'
-- ┌ Number of regexes in section (2 bytes, MSB first) -- ┌ Number of regexes in section (2 bytes, MSB first)
-- │ ┌ Condition length (1 byte) -- │ ┌ Condition length (1 byte)
@ -43,7 +42,6 @@ describe('spellfile', function()
-- ┌ Section identifier (#SN_PREFCOND) -- ┌ Section identifier (#SN_PREFCOND)
-- │ ┌ Section flags (#SNF_REQUIRED or zero) -- │ ┌ Section flags (#SNF_REQUIRED or zero)
-- │ │ ┌ Section length (4 bytes, MSB first) -- │ │ ┌ Section length (4 bytes, MSB first)
-- │ │ │
spellheader .. '\003\001\000\000\000\008' spellheader .. '\003\001\000\000\000\008'
-- ┌ Number of regexes in section (2 bytes, MSB first) -- ┌ Number of regexes in section (2 bytes, MSB first)
-- │ ┌ Condition length (1 byte) -- │ ┌ Condition length (1 byte)
@ -64,7 +62,6 @@ describe('spellfile', function()
-- ┌ Section identifier (#SN_REGION) -- ┌ Section identifier (#SN_REGION)
-- │ ┌ Section flags (#SNF_REQUIRED or zero) -- │ ┌ Section flags (#SNF_REQUIRED or zero)
-- │ │ ┌ Section length (4 bytes, MSB first) -- │ │ ┌ Section length (4 bytes, MSB first)
-- │ │ │
spellheader .. '\000\001\000\000\000\008' spellheader .. '\000\001\000\000\000\008'
-- ┌ Regions ┌ End of sections marker -- ┌ Regions ┌ End of sections marker
.. '01234\00067\255' .. '01234\00067\255'
@ -76,4 +73,28 @@ describe('spellfile', function()
eq('Vim(set):E759: Format error in spell file', eq('Vim(set):E759: Format error in spell file',
exc_exec('set spell')) exc_exec('set spell'))
end) end)
it('errors out when SAL section contains NUL byte', function()
meths.set_option('runtimepath', testdir)
write_file(testdir .. '/spell/en.ascii.spl',
-- ┌ Section identifier (#SN_SAL)
-- │ ┌ Section flags (#SNF_REQUIRED or zero)
-- │ │ ┌ Section length (4 bytes, MSB first)
spellheader .. '\005\001\000\000\000\008'
-- ┌ salflags
-- │ ┌ salcount (2 bytes, MSB first)
-- │ │ ┌ salfromlen (1 byte)
-- │ │ │ ┌ Special character
-- │ │ │ │┌ salfrom (should not contain NUL)
-- │ │ │ ││ ┌ saltolen
-- │ │ │ ││ │ ┌ salto
-- │ │ │ ││ │ │┌ End of sections marker
.. '\000\000\001\0024\000\0017\255'
-- ┌ LWORDTREE tree length (4 bytes)
-- │ ┌ KWORDTREE tree length (4 bytes)
-- │ │ ┌ PREFIXTREE tree length
.. '\000\000\000\000\000\000\000\000\000\000\000\000')
meths.set_option('spelllang', 'en')
eq('Vim(set):E759: Format error in spell file',
exc_exec('set spell'))
end)
end) end)