vim/backport-CVE-2022-2923.patch
shixuantong 803e4a6182 fix CVE-2022-2923 CVE-2022-2946
(cherry picked from commit 7836ddcb362df79773677ccbf8c1d0854f40a295)
2022-08-26 19:08:28 +08:00

55 lines
1.6 KiB
Diff

From 6669de1b235843968e88844ca6d3c8dec4b01a9e Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 21 Aug 2022 20:33:47 +0100
Subject: [PATCH] patch 9.0.0240: crash when using ":mkspell" with an
empty
.dic file
Problem: Crash when using ":mkspell" with an empty .dic file.
Solution: Check for an empty word tree.
---
src/spellfile.c | 4 +++-
src/testdir/test_spellfile.vim | 11 +++++++++++
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/src/spellfile.c b/src/spellfile.c
index aeeb6ad..08dcc1b 100644
--- a/src/spellfile.c
+++ b/src/spellfile.c
@@ -5561,10 +5561,12 @@ sug_filltree(spellinfo_T *spin, slang_T *slang)
/*
* Go through the whole case-folded tree, soundfold each word and put it
- * in the trie.
+ * in the trie. Bail out if the tree is empty.
*/
byts = slang->sl_fbyts;
idxs = slang->sl_fidxs;
+ if (byts == NULL || idxs == NULL)
+ return FAIL;
arridx[0] = 0;
curi[0] = 1;
diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
index 1382c02..4de7389 100644
--- a/src/testdir/test_spellfile.vim
+++ b/src/testdir/test_spellfile.vim
@@ -176,3 +176,14 @@ func Test_check_for_valid_word()
call assert_fails("spellgood! 0^B\xac", 'E1280:')
endfunc
+" this was using a NULL pointer
+func Test_mkspell_empty_dic()
+ call writefile(['1'], 'XtestEmpty.dic')
+ call writefile(['SOFOFROM abcd', 'SOFOTO ABCD', 'SAL CIA X'], 'XtestEmpty.aff')
+ mkspell! XtestEmpty.spl XtestEmpty
+
+ call delete('XtestEmpty.dic')
+ call delete('XtestEmpty.aff')
+ call delete('XtestEmpty.spl')
+endfunc
+
--
2.27.0