IntenseFinance/neovim
3
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-02-25 18:55:25 -06:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.5072: using uninitialized value and freed memory in spell command

Browse Source 
Problem:    Using uninitialized value and freed memory in spell command.
Solution:   Initialize "attr".  Check for empty line early.
2813f38e02
This commit is contained in:
zeertzjq 2022-07-04 09:48:20 +08:00
parent 1ff86aa634
commit a4215a0a21
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/nvim/spell.c
View File

@ -1469,7 +1469,9 @@ size_t spell_move_to(win_T *wp, int dir, bool allwords, bool curline, hlf_T *att
} }
// Copy the line into "buf" and append the start of the next line if // Copy the line into "buf" and append the start of the next line if
// possible. // possible. Note: this ml_get_buf() may make "line" invalid, check
// for empty line first.
bool empty_line = *skipwhite((const char *)line) == NUL;
STRCPY(buf, line); STRCPY(buf, line);
if (lnum < wp->w_buffer->b_ml.ml_line_count) { if (lnum < wp->w_buffer->b_ml.ml_line_count) {
spell_cat_line(buf + STRLEN(buf), spell_cat_line(buf + STRLEN(buf),
@ -1613,7 +1615,7 @@ size_t spell_move_to(win_T *wp, int dir, bool allwords, bool curline, hlf_T *att
--capcol; --capcol;
// But after empty line check first word in next line // But after empty line check first word in next line
if (*skipwhite((char *)line) == NUL) { if (empty_line) {
capcol = 0; capcol = 0;
} }
} }

15
src/nvim/testdir/test_spell_utf8.vim
View File

@ -808,5 +808,20 @@ func Test_word_index()
call delete('Xtmpfile') call delete('Xtmpfile')
endfunc endfunc
func Test_check_empty_line()
" This was using freed memory
enew
spellgood! fl
norm z=
norm yy
sil! norm P]svc
norm P]s
" set 'encoding' to clear the wordt list
set enc=latin1
set enc=utf-8
bwipe!
endfunc
" vim: shiftwidth=2 sts=2 expandtab " vim: shiftwidth=2 sts=2 expandtab