mirror of
https://github.com/neovim/neovim.git
synced 2026-09-09 07:25:51 +00:00
f1833490a0
Problem: `unpack_string()` validates the declared length against `*size`, the size *before* `mpack_rtoken()` consumed the token header, rather than `size2`, the remainder after it. The header is one to five bytes, so any declared length in the window `(size2, *size]` slips through. The returned `String` then covers up to five bytes past the end of the buffer, and `size2 - tok.length` underflows, leaving `*size` near `SIZE_MAX` so every later unpack call on that entry believes it has an unbounded buffer. Reachable from ShaDa, where a history entry ending in a five-byte string header followed by four bytes is enough, so a corrupted or hostile `main.shada` triggers it at startup. Solution: Check the remainder left after the header. AI-assisted