vim/backport-CVE-2022-2126.patch

52 lines
1.4 KiB
Diff
Raw Normal View History

From 156d3911952d73b03d7420dc3540215247db0fe8 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 18 Jun 2022 14:09:08 +0100
Subject: [PATCH] patch 8.2.5123: using invalid index when looking for spell
suggestions
Problem: Using invalid index when looking for spell suggestions.
Solution: Do not decrement the index when it is zero.
---
src/spellsuggest.c | 3 ++-
src/testdir/test_spell.vim | 10 ++++++++++
2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/src/spellsuggest.c b/src/spellsuggest.c
index 2b7d13b..379d9ba 100644
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -1944,7 +1944,8 @@ suggest_trie_walk(
sp->ts_isdiff = (newscore != 0)
? DIFF_YES : DIFF_NONE;
}
- else if (sp->ts_isdiff == DIFF_INSERT)
+ else if (sp->ts_isdiff == DIFF_INSERT
+ && sp->ts_fidx > 0)
// When inserting trail bytes don't advance in the
// bad word.
--sp->ts_fidx;
diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
index c09137a..b6117aa 100644
--- a/src/testdir/test_spell.vim
+++ b/src/testdir/test_spell.vim
@@ -70,6 +70,16 @@ func Test_z_equal_on_invalid_utf8_word()
bwipe!
endfunc
+func Test_z_equal_on_single_character()
+ " this was decrementing the index below zero
+ new
+ norm a0\<5C>
+ norm zW
+ norm z=
+
+ bwipe!
+endfunc
+
" Test spellbadword() with argument
func Test_spellbadword()
set spell
--
1.8.3.1