diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2025-01-12 08:25:57 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-01-12 00:25:57 +0000 |
| commit | 1a8a48d7e5f8243aff0253a82f4214241eb877d6 (patch) | |
| tree | 3c264ae8974a9fa4862a44329fdf919e9fefccb9 /test/old | |
| parent | 37316fbac641ecafde29fd750a08ece490d209c1 (diff) | |
| download | rneovim-1a8a48d7e5f8243aff0253a82f4214241eb877d6.tar.gz rneovim-1a8a48d7e5f8243aff0253a82f4214241eb877d6.tar.bz2 rneovim-1a8a48d7e5f8243aff0253a82f4214241eb877d6.zip | |
vim-patch:9.1.1003: [security]: heap-buffer-overflow with visual mode (#31971)
Problem: [security]: heap-buffer-overflow with visual mode when
using :all, causing Vim trying to access beyond end-of-line
(gandalf)
Solution: Reset visual mode on :all, validate position in gchar_pos()
and charwise_block_prep()
This fixes CVE-2025-22134
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-5rgf-26wj-48v8
https://github.com/vim/vim/commit/c9a1e257f1630a0866447e53a564f7ff96a80ead
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'test/old')
| -rw-r--r-- | test/old/testdir/test_visual.vim | 26 |
1 files changed, 22 insertions, 4 deletions
diff --git a/test/old/testdir/test_visual.vim b/test/old/testdir/test_visual.vim index 39388cbc27..328ac502bf 100644 --- a/test/old/testdir/test_visual.vim +++ b/test/old/testdir/test_visual.vim @@ -470,7 +470,7 @@ func Test_Visual_Block() \ "\t{", \ "\t}"], getline(1, '$')) - close! + bw! endfunc " Test for 'p'ut in visual block mode @@ -1082,7 +1082,7 @@ func Test_star_register() delmarks < > call assert_fails('*yank', 'E20:') - close! + bw! endfunc " Test for changing text in visual mode with 'exclusive' selection @@ -1098,7 +1098,7 @@ func Test_exclusive_selection() call assert_equal('l one', getline(1)) set virtualedit& set selection& - close! + bw! endfunc " Test for starting linewise visual with a count. @@ -1155,7 +1155,7 @@ func Test_visual_inner_block() 8,9d call cursor(5, 1) call assert_beeps('normal ViBiB') - close! + bw! endfunc func Test_visual_put_in_block() @@ -2764,4 +2764,22 @@ func Test_visual_block_exclusive_selection_adjusted() set selection&vim endfunc +" the following caused a Heap-Overflow, because Vim was accessing outside of a +" line end +func Test_visual_pos_buffer_heap_overflow() + set virtualedit=all + args Xa Xb + all + call setline(1, ['', '', '']) + call cursor(3, 1) + wincmd w + call setline(1, 'foobar') + normal! $lv0 + all + call setreg('"', 'baz') + normal! [P + set virtualedit= + bw! Xa Xb +endfunc + " vim: shiftwidth=2 sts=2 expandtab |