diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2025-03-06 07:08:53 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-03-06 07:08:53 +0800 |
| commit | 761e920280ccedb823a56b9da7f02aaf4e1051aa (patch) | |
| tree | cb1d136426d5007a1201cda9a8469bb126e5d63c /src | |
| parent | 35e5307af25785ac90bd00f913fc0df5cf962db3 (diff) | |
| download | rneovim-761e920280ccedb823a56b9da7f02aaf4e1051aa.tar.gz rneovim-761e920280ccedb823a56b9da7f02aaf4e1051aa.tar.bz2 rneovim-761e920280ccedb823a56b9da7f02aaf4e1051aa.zip | |
vim-patch:9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file (#32739)
Problem: heap-buffer-overflow with 'nostartofline' and Ex command in
tag file.
Solution: Set cursor column when moving cursor to line 1 (zeertzjq).
closes: vim/vim#16796
https://github.com/vim/vim/commit/3ed6659549e447ff00def8edc841321e497f70a8
Diffstat (limited to 'src')
| -rw-r--r-- | src/nvim/tag.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/nvim/tag.c b/src/nvim/tag.c index 557d41a467..baa862f57a 100644 --- a/src/nvim/tag.c +++ b/src/nvim/tag.c @@ -2986,6 +2986,8 @@ static int jumpto_tag(const char *lbuf_arg, int forceit, bool keep_help) secure = 1; sandbox++; curwin->w_cursor.lnum = 1; // start command in line 1 + curwin->w_cursor.col = 0; + curwin->w_cursor.coladd = 0; do_cmdline_cmd(pbuf); retval = OK; |