From b55010a539c37efcce10b08ee38df9dd4b4d9fb7 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Sun, 3 Sep 2023 09:12:44 +0800 Subject: vim-patch:9.0.1846: [security] crash in fullcommand Problem: crash in fullcommand Solution: Check for typeval correctly https://github.com/vim/vim/commit/4c6fe2e2ea62469642ed1d80b16d39e616b25cf5 Co-authored-by: Christian Brabandt --- src/nvim/ex_docmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src') diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c index 3ff1442640..44610c81d8 100644 --- a/src/nvim/ex_docmd.c +++ b/src/nvim/ex_docmd.c @@ -3136,7 +3136,7 @@ int cmd_exists(const char *const name) /// "fullcommand" function void f_fullcommand(typval_T *argvars, typval_T *rettv, EvalFuncData fptr) { - char *name = argvars[0].vval.v_string; + char *name = (char *)tv_get_string(&argvars[0]); rettv->v_type = VAR_STRING; rettv->vval.v_string = NULL; -- cgit From 15298e79269e95899b9812c78af19f954b3bcba6 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Sun, 3 Sep 2023 09:14:45 +0800 Subject: vim-patch:9.0.1847: [security] potential oob write in do_addsub() Problem: potential oob write in do_addsub() Solution: don't overflow buf2, check size in for loop() https://github.com/vim/vim/commit/889f6af37164775192e33b233a90e86fd3df0f57 Co-authored-by: Christian Brabandt --- src/nvim/ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src') diff --git a/src/nvim/ops.c b/src/nvim/ops.c index 8270641256..96deae228f 100644 --- a/src/nvim/ops.c +++ b/src/nvim/ops.c @@ -4770,7 +4770,7 @@ int do_addsub(int op_type, pos_T *pos, int length, linenr_T Prenum1) } } - while (bits > 0) { + while (bits > 0 && i < NUMBUFLEN - 1) { buf2[i++] = ((n >> --bits) & 0x1) ? '1' : '0'; } -- cgit