diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-06-17 15:06:58 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2026-06-17 15:22:04 +0800 |
| commit | 52d7bbd1a01d2926d89fbb88d9498b22605102e7 (patch) | |
| tree | 4ff2f1668fb34739d3a6b987f66d75346f57c9e0 /test/functional/vimscript/executable_spec.lua | |
| parent | f50ec42da2e56f72cee22806afd3c3112201e4da (diff) | |
| download | rneovim-52d7bbd1a01d2926d89fbb88d9498b22605102e7.tar.gz rneovim-52d7bbd1a01d2926d89fbb88d9498b22605102e7.tar.bz2 rneovim-52d7bbd1a01d2926d89fbb88d9498b22605102e7.zip | |
vim-patch:9.2.0662: [security] Stack out-of-bounds write in dump_prefixes()
Problem: [security]: a crafted spell file with a self-referential
BY_INDEX node in the prefix tree can drive dump_prefixes()
past the end of its MAXWLEN-sized depth arrays on :spelldump
(cipher-creator)
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
walkers already do (Yasuhiro Matsumoto)
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h
Supported by AI
https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241fc8633d93dff996b
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Diffstat (limited to 'test/functional/vimscript/executable_spec.lua')
0 files changed, 0 insertions, 0 deletions