vim-patch:8.0.0322

Problem:    Possible overflow with spell file where the tree length is
            corrupted.
Solution:   Check for an invalid length (suggested by shqking)

399c297aa9

CVE-2017-5953
This commit is contained in:
James McCoy 2017-04-09 00:45:19 -04:00
parent ad66826abe
commit b338bb9d6c
No known key found for this signature in database
GPG Key ID: DFE691AE331BA3DB

View File

@ -1572,6 +1572,10 @@ spell_read_tree (
int len = get4c(fd);
if (len < 0)
return SP_TRUNCERROR;
if (len >= 0x3ffffff) {
// Invalid length, multiply with sizeof(int) would overflow.
return SP_FORMERROR;
}
if (len > 0) {
// Allocate the byte array.
bp = xmalloc(len);