Vim spellfile.c tree_count_words Out-of-Bounds Write Fix

漏洞概述 在 的 函数中，存在一个安全漏洞，具体为越界写入（out-of-bounds write）。该漏洞发生在处理 大小的深度数组时，由于循环没有深度限制，导致数组越界写入。 影响范围 受影响版本：v9.2.0653 及之前版本。 影响模块： 中的 函数。 潜在风险：可能导致程序崩溃或执行任意代码。 修复方案 1. 代码修改： - 在 函数中，增加深度限制，确保 不超过 。 - 具体修改如下： 2. 测试用例： - 添加了测试用例 ，用于验证修复后的代码是否正确处理越界情况。 - 测试用例代码如下： ```vim func Test_spell_sug_tree_count_words_overflow() " A crafted 'sug'/'sug' pair with a RT_INDEX self-cycle in the field word tree " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth " can never trip), but drove tree_count_words() past its MAXLEN-sized depth " arrays -> stack out-of-bounds write. The walk only happens when " 'spelluglist' loads the matching .sug. Reaching the assert = no 000. call assert_equal('Xrtp/spell/pt', 'gP') " Vim9script + xdb, SN_SUPFILE(tis), SN_END, LMROOTTREE(node1, BY_INDEX=0, 'A') " + empty KAMROOTTREE/PREFIXTREE let spt = eval('0x564040737065666c208000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

目標達成すべての支援者に感謝 — 100%達成しました！

Vim spellfile.c tree_count_words Out-of-Bounds Write Fix

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Vim spellfile.c tree_count_words Out-of-Bounds Write Fix

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！