neovim

commit 0fe4362e216e659e5236cf49beba0e10cce0579d
parent 0ba388847417b8aed469976acf94f9633cb03f15
Author: Devon Gardner <devon@goosur.com>
Date:   Thu, 19 Sep 2024 08:33:40 +0000

fix(coverity/509227/509228): tui driver_ti underflow #30341

Problem:
write() can return -1 but is cast to unsigned type causing coverity
to detect possible overflowed integer

Solution:
Perform check to ensure all negative values are captured rather than
just -1 before casting to unsigned type
Diffstat:
M
src/nvim/tui/termkey/driver-ti.c
 | 
10
++++++----

1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/src/nvim/tui/termkey/driver-ti.c b/src/nvim/tui/termkey/driver-ti.c
@@ -410,10 +410,11 @@ int start_driver_ti(TermKey *tk, void *info)
   // Can't call putp or tputs because they suck and don't give us fd control
   len = strlen(start_string);
   while (len) {
-    size_t written = (size_t)write(tk->fd, start_string, (unsigned)len);
-    if (written == (size_t)-1) {
+    ssize_t result = write(tk->fd, start_string, (unsigned)len);
+    if (result < 0) {
       return 0;
     }
+    size_t written = (size_t)result;
     start_string += written;
     len -= written;
   }
@@ -448,10 +449,11 @@ int stop_driver_ti(TermKey *tk, void *info)
   // Can't call putp or tputs because they suck and don't give us fd control
   len = strlen(stop_string);
   while (len) {
-    size_t written = (size_t)write(tk->fd, stop_string, (unsigned)len);
-    if (written == (size_t)-1) {
+    ssize_t result = write(tk->fd, stop_string, (unsigned)len);
+    if (result < 0) {
       return 0;
     }
+    size_t written = (size_t)result;
     stop_string += written;
     len -= written;
   }