lua/executor: Fix crash when first string contains NUL and second not

This commit is contained in:
ZyX
2017-08-15 16:41:43 +03:00
parent 93ef823f5e
commit b1a8dcefee
2 changed files with 24 additions and 14 deletions

View File

@@ -137,23 +137,28 @@ static int nlua_stricmp(lua_State *const lstate) FUNC_ATTR_NONNULL_ALL
nul1 = memchr(s1, NUL, s1_len); nul1 = memchr(s1, NUL, s1_len);
nul2 = memchr(s2, NUL, s2_len); nul2 = memchr(s2, NUL, s2_len);
ret = STRICMP(s1, s2); ret = STRICMP(s1, s2);
// Compare "a\0" greater then "a". if (ret == 0) {
if (ret == 0 && (nul1 == NULL) != (nul2 == NULL)) { // Compare "a\0" greater then "a".
ret = ((nul1 != NULL) - (nul2 != NULL)); if ((nul1 == NULL) != (nul2 == NULL)) {
break; ret = ((nul1 != NULL) - (nul2 != NULL));
} break;
if (nul1 != NULL) { }
assert(nul2 != NULL); if (nul1 != NULL) {
// Due to lowercase letter having possibly different byte length then assert(nul2 != NULL);
// uppercase letter cant shift both strings by the same amount of bytes. // Due to lowercase letter having possibly different byte length then
s1_len -= (size_t)(nul1 - s1) + 1; // uppercase letter cant shift both strings by the same amount of
s2_len -= (size_t)(nul2 - s2) + 1; // bytes.
s1 = nul1 + 1; s1_len -= (size_t)(nul1 - s1) + 1;
s2 = nul2 + 1; s2_len -= (size_t)(nul2 - s2) + 1;
s1 = nul1 + 1;
s2 = nul2 + 1;
} else {
break;
}
} else { } else {
break; break;
} }
} while (ret == 0); } while (true);
lua_pop(lstate, 2); lua_pop(lstate, 2);
lua_pushnumber(lstate, (lua_Number)((ret > 0) - (ret < 0))); lua_pushnumber(lstate, (lua_Number)((ret > 0) - (ret < 0)));
return 1; return 1;

View File

@@ -89,6 +89,11 @@ describe('vim.stricmp', function()
eq(1, funcs.luaeval('vim.stricmp("c\\0", "b\\0")')) eq(1, funcs.luaeval('vim.stricmp("c\\0", "b\\0")'))
eq(1, funcs.luaeval('vim.stricmp("C\\0", "B\\0")')) eq(1, funcs.luaeval('vim.stricmp("C\\0", "B\\0")'))
eq(1, funcs.luaeval('vim.stricmp("c\\0", "B")'))
eq(1, funcs.luaeval('vim.stricmp("C\\0", "b")'))
eq(1, funcs.luaeval('vim.stricmp("c\\0", "b")'))
eq(1, funcs.luaeval('vim.stricmp("C\\0", "B")'))
eq(1, funcs.luaeval('vim.stricmp("\\0c", "\\0B")')) eq(1, funcs.luaeval('vim.stricmp("\\0c", "\\0B")'))
eq(1, funcs.luaeval('vim.stricmp("\\0C", "\\0b")')) eq(1, funcs.luaeval('vim.stricmp("\\0C", "\\0b")'))
eq(1, funcs.luaeval('vim.stricmp("\\0c", "\\0b")')) eq(1, funcs.luaeval('vim.stricmp("\\0c", "\\0b")'))