Mercurial > vim
comparison src/ops.c @ 33789:2175a980f3eb v9.0.2113
patch 9.0.2113: Coverity warns for another overflow in shift_line()
Commit: https://github.com/vim/vim/commit/22a97fc241361aa91bda84e5344d5b7c0cda3e81
Author: Christian Brabandt <cb@256bit.org>
Date: Sun Nov 19 10:45:24 2023 +0100
patch 9.0.2113: Coverity warns for another overflow in shift_line()
Problem: Coverity warns for another overflow in shift_line()
Solution: Test for INT_MAX after the if condition, cast integer values
to (long long) before multiplying.
Signed-off-by: Christian Brabandt <cb@256bit.org>
Signed-off-by: Michael Henry <vim@drmikehenry.com>
Signed-off-by: Ernie Rael <errael@raelity.com>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Sun, 19 Nov 2023 11:00:05 +0100 |
parents | 872c07d5befe |
children | 2e92551b2350 |
comparison
equal
deleted
inserted
replaced
33788:5ea4c560f01c | 33789:2175a980f3eb |
---|---|
247 if (i < 0) | 247 if (i < 0) |
248 i = 0; | 248 i = 0; |
249 } | 249 } |
250 else | 250 else |
251 i += amount; | 251 i += amount; |
252 count = i * sw_val; | 252 count = (long long)i * (long long)sw_val; |
253 } | 253 } |
254 else // original vi indent | 254 else // original vi indent |
255 { | 255 { |
256 if (left) | 256 if (left) |
257 { | 257 { |
258 count -= sw_val * amount; | 258 count -= (long long)sw_val * (long long)amount; |
259 if (count < 0) | 259 if (count < 0) |
260 count = 0; | 260 count = 0; |
261 } | 261 } |
262 else | 262 else |
263 { | 263 count += (long long)sw_val * (long long)amount; |
264 if ((long long)sw_val * (long long)amount > INT_MAX - count) | 264 } |
265 count = INT_MAX; | 265 |
266 else | 266 if (count > INT_MAX) |
267 count += (long long)sw_val * (long long)amount; | 267 count = INT_MAX; |
268 } | |
269 } | |
270 | 268 |
271 // Set new indent | 269 // Set new indent |
272 if (State & VREPLACE_FLAG) | 270 if (State & VREPLACE_FLAG) |
273 change_indent(INDENT_SET, (int)count, FALSE, NUL, call_changed_bytes); | 271 change_indent(INDENT_SET, (int)count, FALSE, NUL, call_changed_bytes); |
274 else | 272 else |