From ff7832ad3fce55671ac4032716164ada0350b0ec Mon Sep 17 00:00:00 2001
From: Devon Gardner <devon@goosur.com>
Date: Sat, 5 Oct 2024 14:18:00 +0000
Subject: [PATCH] fix(coverity/497355): shada_read_when_writing out of bounds
 read #30665

Problem:
There appears to be an intentional array out of bounds read when
indexing global and numbered marks since they are adjacent in the struct
that holds them.

Solution:
Explicitly index numeric marks array to avoid reading out of bounds from
global marks array.
---
 src/nvim/shada.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/nvim/shada.c b/src/nvim/shada.c
index 6b8770e22d..1ea9f214fb 100644
--- a/src/nvim/shada.c
+++ b/src/nvim/shada.c
@@ -1886,13 +1886,18 @@ static inline ShaDaWriteResult shada_read_when_writing(FileDescriptor *const sd_
           shada_free_shada_entry(&entry);
           break;
         }
-        if (wms->global_marks[idx].data.type == kSDItemMissing) {
+
+        // Global or numbered mark.
+        PossiblyFreedShadaEntry *mark
+          = idx < 26 ? &wms->global_marks[idx] : &wms->numbered_marks[idx];
+
+        if (mark->data.type == kSDItemMissing) {
           if (namedfm[idx].fmark.timestamp >= entry.timestamp) {
             shada_free_shada_entry(&entry);
             break;
           }
         }
-        COMPARE_WITH_ENTRY(&wms->global_marks[idx], entry);
+        COMPARE_WITH_ENTRY(mark, entry);
       }
       break;
     case kSDItemChange: