diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-02-28 09:22:41 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-02-28 09:22:41 +0800 |
| commit | a416494e648b18a41fd5d1cdcf04ef0e05c15926 (patch) | |
| tree | dd836ed24086addd904f6b2b8ae1c7e3c51ab986 /runtime/lua/vim/provider/python.lua | |
| parent | 7e65c44cfbab533b7b96cf643f31e37a7b01e8c4 (diff) | |
| download | rneovim-a416494e648b18a41fd5d1cdcf04ef0e05c15926.tar.gz rneovim-a416494e648b18a41fd5d1cdcf04ef0e05c15926.tar.bz2 rneovim-a416494e648b18a41fd5d1cdcf04ef0e05c15926.zip | |
vim-patch:9.2.0078: [security]: stack-buffer-overflow in build_stl_str_hl() (#38102)
Problem: A stack-buffer-overflow occurs when rendering a statusline
with a multi-byte fill character on a very wide terminal.
The size check in build_stl_str_hl() uses the cell width
rather than the byte length, allowing the subsequent fill
loop to write beyond the 4096-byte MAXPATHL buffer
(ehdgks0627, un3xploitable).
Solution: Update the size check to account for the byte length of
the fill character (using MB_CHAR2LEN).
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-gmqx-prf2-8mwf
https://github.com/vim/vim/commit/4e5b9e31cb7484ad156fba995fdce3c9b075b5fd
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'runtime/lua/vim/provider/python.lua')
0 files changed, 0 insertions, 0 deletions