neovim

commit 60e1862ccba744c4252d30f043bb077c2c657427
parent 5805716ca4dac8f214ed5fd8c3f0a5905a394e8c
Author: Devon Gardner <devon@goosur.com>
Date:   Mon,  7 Oct 2024 23:22:09 +0000

fix(coverity/510275): linematch out of bounds access (#30687)

Problem:
Int pointer cast to unsigned long pointer causes potential memory
corruption.

Solution:
Cast and store value first, then pass the new pointer.
Diffstat:
M
src/nvim/linematch.c
 | 
4
+++-

1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/nvim/linematch.c b/src/nvim/linematch.c
@@ -150,7 +150,9 @@ static int count_n_matched_chars(mmfile_t **sp, const size_t n, bool iwhite)
 mmfile_t fastforward_buf_to_lnum(mmfile_t s, linenr_T lnum)
 {
   for (int i = 0; i < lnum - 1; i++) {
-    s.ptr = strnchr(s.ptr, (size_t *)&s.size, '\n');
+    size_t n = (size_t)s.size;
+    s.ptr = strnchr(s.ptr, &n, '\n');
+    s.size = (int)n;
     if (!s.ptr) {
       break;
     }