vis

commit 621f93e6f2d221b105a55a54612550556282b85e
parent bca24c58de1548202f0e3603d4ac9f2940b9a6a5
Author: Marc André Tanner <mat@brain-dump.org>
Date:   Mon, 20 Feb 2017 12:16:23 +0100

text: fix some integer overflow issues

Diffstat:
M
text.c
 | 
9
++++++---

1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/text.c b/text.c
@@ -292,7 +292,8 @@ static bool block_insert(Block *blk, size_t pos, const char *data, size_t len) {
 /* delete data from a block at an arbitrary position, this should only be used with
  * data of the most recently created piece. */
 static bool block_delete(Block *blk, size_t pos, size_t len) {
-	if (pos + len > blk->len)
+	size_t end;
+	if (!addu(pos, len, &end) || end > blk->len)
 		return false;
 	if (blk->len == pos) {
 		blk->len -= len;
@@ -356,8 +357,9 @@ static bool cache_delete(Text *txt, Piece *p, size_t off, size_t len) {
 	if (!cache_contains(txt, p))
 		return false;
 	Block *blk = txt->blocks;
+	size_t end;
 	size_t bufpos = p->data + off - blk->data;
-	if (off + len > p->len || !block_delete(blk, bufpos, len))
+	if (!addu(off, len, &end) || end > p->len || !block_delete(blk, bufpos, len))
 		return false;
 	p->len -= len;
 	txt->current_revision->change->new.len -= len;
@@ -1182,7 +1184,8 @@ struct stat text_stat(Text *txt) {
 bool text_delete(Text *txt, size_t pos, size_t len) {
 	if (len == 0)
 		return true;
-	if (pos + len > txt->size)
+	size_t pos_end;
+	if (!addu(pos, len, &pos_end) || pos_end > txt->size)
 		return false;
 	if (pos < txt->lines.pos)
 		lineno_cache_invalidate(&txt->lines);