mirror of
https://github.com/neovim/neovim.git
synced 2025-09-29 14:38:32 +00:00
treesitter: check for integer overflow (#12135)
Sometimes treesitter calls for an invalid column within a line, checking that the column is actually valid and forcing the value avoids an integer overflow and an infinite sequence of invalid reads. Fixes #12131
This commit is contained in:
@@ -271,6 +271,10 @@ static const char *input_cb(void *payload, uint32_t byte_index,
|
||||
}
|
||||
char_u *line = ml_get_buf(bp, position.row+1, false);
|
||||
size_t len = STRLEN(line);
|
||||
|
||||
if (position.column > len) {
|
||||
*bytes_read = 0;
|
||||
} else {
|
||||
size_t tocopy = MIN(len-position.column, BUFSIZE);
|
||||
|
||||
memcpy(buf, line+position.column, tocopy);
|
||||
@@ -283,6 +287,7 @@ static const char *input_cb(void *payload, uint32_t byte_index,
|
||||
buf[tocopy] = '\n';
|
||||
(*bytes_read)++;
|
||||
}
|
||||
}
|
||||
return buf;
|
||||
#undef BUFSIZE
|
||||
}
|
||||
|
Reference in New Issue
Block a user