qsort may deref NULL pointer

chrisbra · Jul 18, 2024 · 0a631cb · 0a631cb
1 parent 5ad0199
commit 0a631cb
Showing 1 changed file with 9 additions and 5 deletions.
diff --git a/src/insexpand.c b/src/insexpand.c
@@ -3588,12 +3588,16 @@ get_next_filename_completion(void)
 	    }
 	}
 
-	fuzzy_indices_data = (int *)fuzzy_indices.ga_data;
-	qsort(fuzzy_indices_data, fuzzy_indices.ga_len, sizeof(int), compare_scores);
+	// prevent qsort from deref NULL pointer
+	if (fuzzy_indices.ga_len > 0)
+	{
+	    fuzzy_indices_data = (int *)fuzzy_indices.ga_data;
+	    qsort(fuzzy_indices_data, fuzzy_indices.ga_len, sizeof(int), compare_scores);
 
-	sorted_matches = (char_u **)alloc(sizeof(char_u *) * fuzzy_indices.ga_len);
-	for (i = 0; i < fuzzy_indices.ga_len; ++i)
-	    sorted_matches[i] = vim_strsave(matches[fuzzy_indices_data[i]]);
+	    sorted_matches = (char_u **)alloc(sizeof(char_u *) * fuzzy_indices.ga_len);
+	    for (i = 0; i < fuzzy_indices.ga_len; ++i)
+		sorted_matches[i] = vim_strsave(matches[fuzzy_indices_data[i]]);
+	}
 
 	FreeWild(num_matches, matches);
 	matches = sorted_matches;