diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2023-09-03 13:47:55 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-09-03 13:47:55 +0800 |
| commit | bebdf1dab345471222f6755c574d04596fea92fd (patch) | |
| tree | 844dd19dd408a76643dcdf6fa7cb569b63c3f148 /test | |
| parent | 0e11bf0e1af5b3422db49222ab739a64d233b353 (diff) | |
| download | rneovim-bebdf1dab345471222f6755c574d04596fea92fd.tar.gz rneovim-bebdf1dab345471222f6755c574d04596fea92fd.tar.bz2 rneovim-bebdf1dab345471222f6755c574d04596fea92fd.zip | |
vim-patch:9.0.1848: [security] buffer-overflow in vim_regsub_both() (#25001)
Problem: buffer-overflow in vim_regsub_both()
Solution: Check remaining space
https://github.com/vim/vim/commit/ced2c7394aafdc90fb7845e09b3a3fee23d48cb1
The change to do_sub() looks confusing. Maybe it's an overflow check?
Then the crash may not be applicable to Nvim because of different casts.
The test also looks confusing. It seems to source itself recursively.
Also don't call strlen() twice on evaluation result.
N/A patches for version.c:
vim-patch:9.0.1849: CI error on different signedness in ex_cmds.c
vim-patch:9.0.1853: CI error on different signedness in regexp.c
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'test')
| -rw-r--r-- | test/old/testdir/crash/vim_regsub_both | 10 | ||||
| -rw-r--r-- | test/old/testdir/test_crash.vim | 11 |
2 files changed, 20 insertions, 1 deletions
diff --git a/test/old/testdir/crash/vim_regsub_both b/test/old/testdir/crash/vim_regsub_both new file mode 100644 index 0000000000..a82b205c8f --- /dev/null +++ b/test/old/testdir/crash/vim_regsub_both @@ -0,0 +1,10 @@ +fu R() +sil!norm0z= +endf +cal R() +s/\%')/\=R() +d +no0 norm yynore sm:vs0@vvvvvvvvvvse()dir(¼Xtest=csd{so88 +vs +0scr +so diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 0dea3c2cb1..445fe8d5a7 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -6,7 +6,7 @@ CheckScreendump func Test_crash1() " The following used to crash Vim - let opts = #{wait_for_ruler: 0} + let opts = #{wait_for_ruler: 0, rows: 20} let args = ' -u NONE -i NONE -n -e -s -S ' let buf = RunVimInTerminal(args .. ' crash/poc_huaf1', opts) call VerifyScreenDump(buf, 'Test_crash_01', {}) @@ -22,4 +22,13 @@ func Test_crash1() endfunc +func Test_crash2() + " The following used to crash Vim + let opts = #{wait_for_ruler: 0, rows: 20} + let args = ' -u NONE -i NONE -n -e -s -S ' + let buf = RunVimInTerminal(args .. ' crash/vim_regsub_both', opts) + call VerifyScreenDump(buf, 'Test_crash_01', {}) + exe buf .. "bw!" +endfunc + " vim: shiftwidth=2 sts=2 expandtab |