mirror of
https://github.com/neovim/neovim.git
synced 2026-07-24 09:50:48 +00:00
52d7bbd1a0
Problem: [security]: a crafted spell file with a self-referential
BY_INDEX node in the prefix tree can drive dump_prefixes()
past the end of its MAXWLEN-sized depth arrays on :spelldump
(cipher-creator)
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
walkers already do (Yasuhiro Matsumoto)
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h
Supported by AI
8325b193bb
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>