diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-02-28 12:33:47 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-02-28 04:33:47 +0000 |
| commit | 7e8bdd348c3bb6074ab795b97addb818705991bf (patch) | |
| tree | 2f29ebc6dfa4c1a5649e24627b58b7c27e438d72 /runtime/lua/vim/provider/python.lua | |
| parent | a416494e648b18a41fd5d1cdcf04ef0e05c15926 (diff) | |
| download | rneovim-7e8bdd348c3bb6074ab795b97addb818705991bf.tar.gz rneovim-7e8bdd348c3bb6074ab795b97addb818705991bf.tar.bz2 rneovim-7e8bdd348c3bb6074ab795b97addb818705991bf.zip | |
vim-patch:9.2.0077: [security]: Crash when recovering a corrupted swap file (#38104)
Problem: memline: a crafted swap files with bogus pe_page_count/pe_bnum
values could cause a multi-GB allocation via mf_get(), and
invalid pe_old_lnum/pe_line_count values could cause a SEGV
when passed to readfile() (ehdgks0627, un3xploitable)
Solution: Add bounds checks on pe_page_count and pe_bnum against
mf_blocknr_max before descending into the block tree, and
validate pe_old_lnum >= 1 and pe_line_count > 0 before calling
readfile().
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-r2gw-2x48-jj5p
https://github.com/vim/vim/commit/65c1a143c331c886dc28888dd632708f953b4eb3
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'runtime/lua/vim/provider/python.lua')
0 files changed, 0 insertions, 0 deletions