diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-06-16 09:57:45 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-06-16 09:57:45 +0800 |
| commit | 635939da3e354a925d85397d56fb7e9208bf5223 (patch) | |
| tree | 45f4ea77b3f389b247b17e5699142299c016b830 /test/functional/vimscript/executable_spec.lua | |
| parent | 17d4f4c5d8a7a950408e135a8e6632820f9a42c1 (diff) | |
| download | rneovim-635939da3e354a925d85397d56fb7e9208bf5223.tar.gz rneovim-635939da3e354a925d85397d56fb7e9208bf5223.tar.bz2 rneovim-635939da3e354a925d85397d56fb7e9208bf5223.zip | |
vim-patch:9.2.0653: [security]: out-of-bounds write in tree_count_words() (#40279)
Problem: [security]: a crafted spell file can drive tree_count_words()
past the end of its MAXWLEN-sized depth arrays; the descent
loop has no depth bound.
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
walkers already do; apply the same guard to sug_filltree().
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq
Supported by AI.
https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'test/functional/vimscript/executable_spec.lua')
0 files changed, 0 insertions, 0 deletions