vis

commit bbf096d84d319ae24ec31716fbf7ae5e776f751a
parent 12f5494ece1c11f40be59ad7ffd5f282bc6986bf
Author: Marc André Tanner <mat@brain-dump.org>
Date:   Sun, 10 Jan 2016 11:52:02 +0100

text-motion: fix integer overflow in text_search_{forward,backward}

Diffstat:
M
text-motions.c
 | 
12
++++++------

1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/text-motions.c b/text-motions.c
@@ -616,10 +616,10 @@ size_t text_bracket_match_except(Text *txt, size_t pos, const char *except) {
 }
 
 size_t text_search_forward(Text *txt, size_t pos, Regex *regex) {
-	int start = pos + 1;
-	int end = text_size(txt);
+	size_t start = pos + 1;
+	size_t end = text_size(txt);
 	RegexMatch match[1];
-	bool found = !text_search_range_forward(txt, start, end - start, regex, 1, match, 0);
+	bool found = start < end && !text_search_range_forward(txt, start, end - start, regex, 1, match, 0);
 
 	if (!found) {
 		start = 0;
@@ -631,15 +631,15 @@ size_t text_search_forward(Text *txt, size_t pos, Regex *regex) {
 }
 
 size_t text_search_backward(Text *txt, size_t pos, Regex *regex) {
-	int start = 0;
-	int end = pos;
+	size_t start = 0;
+	size_t end = pos;
 	RegexMatch match[1];
 	bool found = !text_search_range_backward(txt, start, end, regex, 1, match, 0);
 
 	if (!found) {
 		start = pos + 1;
 		end = text_size(txt);
-		found = !text_search_range_backward(txt, start, end - start, regex, 1, match, 0);
+		found = start < end && !text_search_range_backward(txt, start, end - start, regex, 1, match, 0);
 	}
 
 	return found ? match[0].start : pos;