diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-06-27 17:21:05 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-06-27 09:21:05 +0000 |
| commit | f3fbb3928cffd415e2b243e67683d032173eb8cc (patch) | |
| tree | 517d961f4f2ef981d41f4bd9112b80db2ef6d527 /runtime/ftplugin | |
| parent | 6a61c81e312b0783f9f5ddd5eb7348bda5e09830 (diff) | |
| download | rneovim-f3fbb3928cffd415e2b243e67683d032173eb8cc.tar.gz rneovim-f3fbb3928cffd415e2b243e67683d032173eb8cc.tar.bz2 rneovim-f3fbb3928cffd415e2b243e67683d032173eb8cc.zip | |
vim-patch:9.2.0738: ml_recover() may write beyond block buffer (#40446)
Problem: A crafted swap file can cause an out-of-bounds write during
recovery when the same block is referenced twice with
different pe_page_count values (cipher-creator)
Solution: Check hp->bh_page_count against page_count after mf_get() and
clamp page_count to the actual block size.
closes: vim/vim#20645
https://github.com/vim/vim/commit/43939cf9ebf5302bb51c85d00ac83de7e01452d5
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'runtime/ftplugin')
0 files changed, 0 insertions, 0 deletions