91 lines
2.4 KiB
Diff
91 lines
2.4 KiB
Diff
From 5e59ea54c0c37c2f84770f068d95280069828774 Mon Sep 17 00:00:00 2001
|
||
From: Bram Moolenaar <Bram@vim.org>
|
||
Date: Fri, 1 Jul 2022 22:26:20 +0100
|
||
Subject: [PATCH] patch 9.0.0021: invalid memory access when adding word to
|
||
spell word list
|
||
|
||
Problem: Invalid memory access when adding word with a control character to
|
||
the internal spell word list.
|
||
Solution: Disallow adding a word with control characters or a trailing
|
||
slash.
|
||
---
|
||
src/spellfile.c | 21 +++++++++++++++++++--
|
||
src/testdir/test_spell.vim | 15 +++++++++++++++
|
||
2 files changed, 34 insertions(+), 2 deletions(-)
|
||
|
||
diff --git a/src/spellfile.c b/src/spellfile.c
|
||
index f0d6d96..4a0de52 100644
|
||
--- a/src/spellfile.c
|
||
+++ b/src/spellfile.c
|
||
@@ -4367,6 +4367,23 @@ wordtree_alloc(spellinfo_T *spin)
|
||
}
|
||
|
||
/*
|
||
+ * Return TRUE if "word" contains valid word characters.
|
||
+ * Control characters and trailing '/' are invalid. Space is OK.
|
||
+ */
|
||
+ static int
|
||
+valid_spell_word(char_u *word)
|
||
+{
|
||
+ char_u *p;
|
||
+
|
||
+ if (enc_utf8 && !utf_valid_string(word, NULL))
|
||
+ return FALSE;
|
||
+ for (p = word; *p != NUL; p += mb_ptr2len(p))
|
||
+ if (*p < ' ' || (p[0] == '/' && p[1] == NUL))
|
||
+ return FALSE;
|
||
+ return TRUE;
|
||
+}
|
||
+
|
||
+/*
|
||
* Store a word in the tree(s).
|
||
* Always store it in the case-folded tree. For a keep-case word this is
|
||
* useful when the word can also be used with all caps (no WF_FIXCAP flag) and
|
||
@@ -4391,7 +4408,7 @@ store_word(
|
||
char_u *p;
|
||
|
||
// Avoid adding illegal bytes to the word tree.
|
||
- if (enc_utf8 && !utf_valid_string(word, NULL))
|
||
+ if (!valid_spell_word(word))
|
||
return FAIL;
|
||
|
||
(void)spell_casefold(curwin, word, len, foldword, MAXWLEN);
|
||
@@ -6194,7 +6211,7 @@ spell_add_word(
|
||
int i;
|
||
char_u *spf;
|
||
|
||
- if (enc_utf8 && !utf_valid_string(word, NULL))
|
||
+ if (!valid_spell_word(word))
|
||
{
|
||
emsg(_(e_illegal_character_in_word));
|
||
return;
|
||
diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
|
||
index 0fd5ed9..0187a17 100644
|
||
--- a/src/testdir/test_spell.vim
|
||
+++ b/src/testdir/test_spell.vim
|
||
@@ -854,6 +854,21 @@ func Test_spellsuggest_too_deep()
|
||
bwipe!
|
||
endfunc
|
||
|
||
+func Test_spell_good_word_invalid()
|
||
+ " This was adding a word with a 0x02 byte, which causes havoc.
|
||
+ enew
|
||
+ norm o0
|
||
+ sil! norm rzzWs00/
|
||
+ 2
|
||
+ sil! norm VzGprzzW
|
||
+ sil! norm z=
|
||
+
|
||
+ bwipe!
|
||
+ " clear the internal word list
|
||
+ set enc=latin1
|
||
+ set enc=utf-8
|
||
+endfunc
|
||
+
|
||
func LoadAffAndDic(aff_contents, dic_contents)
|
||
set enc=latin1
|
||
set spellfile=
|
||
--
|
||
1.8.3.1
|
||
|