lua/executor: Fix crash when first string contains NUL and second not

2 files changed, 24 insertions, 14 deletions

diff --git a/src/nvim/lua/executor.c b/src/nvim/lua/executor.c
index 90333be541..54973a6e94 100644
--- a/src/nvim/lua/executor.c
+++ b/src/nvim/lua/executor.c
@@ -137,23 +137,28 @@ static int nlua_stricmp(lua_State *const lstate) FUNC_ATTR_NONNULL_ALL
     nul1 = memchr(s1, NUL, s1_len);
     nul2 = memchr(s2, NUL, s2_len);
     ret = STRICMP(s1, s2);
-    // Compare "a\0" greater then "a".
-    if (ret == 0 && (nul1 == NULL) != (nul2 == NULL)) {
-      ret = ((nul1 != NULL) - (nul2 != NULL));
-      break;
-    }
-    if (nul1 != NULL) {
-      assert(nul2 != NULL);
-      // Due to lowercase letter having possibly different byte length then
-      // uppercase letter can’t shift both strings by the same amount of bytes.
-      s1_len -= (size_t)(nul1 - s1) + 1;
-      s2_len -= (size_t)(nul2 - s2) + 1;
-      s1 = nul1 + 1;
-      s2 = nul2 + 1;
+    if (ret == 0) {
+      // Compare "a\0" greater then "a".
+      if ((nul1 == NULL) != (nul2 == NULL)) {
+        ret = ((nul1 != NULL) - (nul2 != NULL));
+        break;
+      }
+      if (nul1 != NULL) {
+        assert(nul2 != NULL);
+        // Due to lowercase letter having possibly different byte length then
+        // uppercase letter can’t shift both strings by the same amount of
+        // bytes.
+        s1_len -= (size_t)(nul1 - s1) + 1;
+        s2_len -= (size_t)(nul2 - s2) + 1;
+        s1 = nul1 + 1;
+        s2 = nul2 + 1;
+      } else {
+        break;
+      }
     } else {
       break;
     }
-  } while (ret == 0);
+  } while (true);
   lua_pop(lstate, 2);
   lua_pushnumber(lstate, (lua_Number)((ret > 0) - (ret < 0)));
   return 1;
diff --git a/test/functional/lua/utility_functions_spec.lua b/test/functional/lua/utility_functions_spec.lua
index c2c61299b1..9855a05e8c 100644
--- a/test/functional/lua/utility_functions_spec.lua
+++ b/test/functional/lua/utility_functions_spec.lua
@@ -89,6 +89,11 @@ describe('vim.stricmp', function()
     eq(1, funcs.luaeval('vim.stricmp("c\\0", "b\\0")'))
     eq(1, funcs.luaeval('vim.stricmp("C\\0", "B\\0")'))
 
+    eq(1, funcs.luaeval('vim.stricmp("c\\0", "B")'))
+    eq(1, funcs.luaeval('vim.stricmp("C\\0", "b")'))
+    eq(1, funcs.luaeval('vim.stricmp("c\\0", "b")'))
+    eq(1, funcs.luaeval('vim.stricmp("C\\0", "B")'))
+
     eq(1, funcs.luaeval('vim.stricmp("\\0c", "\\0B")'))
     eq(1, funcs.luaeval('vim.stricmp("\\0C", "\\0b")'))
     eq(1, funcs.luaeval('vim.stricmp("\\0c", "\\0b")'))