diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2023-11-17 09:22:30 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2023-11-17 09:54:03 +0800 |
| commit | eae10de14e8584b8c6c2b7b8255c8191b969698d (patch) | |
| tree | 5ca4d418bfa2d90996a158b0c44daae794610f7a | |
| parent | 6867d2492c1788dfab0a40d0fe453c4a3ce52e28 (diff) | |
| download | rneovim-eae10de14e8584b8c6c2b7b8255c8191b969698d.tar.gz rneovim-eae10de14e8584b8c6c2b7b8255c8191b969698d.tar.bz2 rneovim-eae10de14e8584b8c6c2b7b8255c8191b969698d.zip | |
vim-patch:9.0.1873: [security] heap-buffer-overflow in vim_regsub_both
Problem: heap-buffer-overflow in vim_regsub_both
Solution: Disallow exchanging windows when textlock is active
https://github.com/vim/vim/commit/f6d28fe2c95c678cc3202cc5dc825a3fcc709e93
Cherry-pick test_crash.vim change from patch 9.0.1876.
Co-authored-by: Christian Brabandt <cb@256bit.org>
| -rw-r--r-- | test/old/testdir/test_crash.vim | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index e0884e5a05..aa30684291 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -46,6 +46,7 @@ func Test_crash1() let file = 'crash/poc_tagfunc.vim' let args = printf(cmn_args, vim, file) + " using || because this poc causes vim to exit with exitstatus != 0 call term_sendkeys(buf, args .. \ ' || echo "crash 5: [OK]" >> X_crash1_result.txt' .. "\<cr>") @@ -59,6 +60,12 @@ func Test_crash1() call delete('X') call TermWait(buf, 3000) + let file = 'crash/vim_regsub_both_poc' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\<cr>") + call TermWait(buf, 1000) + " clean up exe buf .. "bw!" @@ -71,6 +78,7 @@ func Test_crash1() \ 'crash 4: [OK]', \ 'crash 5: [OK]', \ 'crash 6: [OK]', + \ 'crash 7: [OK]', \ ] call assert_equal(expected, getline(1, '$')) |