diff options
| author | Christian Brabandt <cb@256bit.org> | 2024-08-22 21:40:14 +0200 |
|---|---|---|
| committer | Christian Brabandt <cb@256bit.org> | 2024-08-22 21:40:14 +0200 |
| commit | cacb6693c10bb19f28a50eca47bc4bc33eccbae3 (patch) | |
| tree | 2eeb32f04fc39ff7a9cbaadcff92337c79713266 | |
| parent | 95e90781a4c92b7b061213cfa38b35bdbf719cc1 (diff) | |
patch 9.1.0689: [security]: buffer-overflow in do_search() with 'rightleft'v9.1.0689
Problem: buffer-overflow in do_search() with 'rightleft'
(SuyueGuo)
Solution: after reversing the text (which allocates a new buffer),
re-calculate the text length
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-v2x2-cjcg-f9jm
Signed-off-by: Christian Brabandt <cb@256bit.org>
| -rw-r--r-- | src/search.c | 1 | ||||
| -rw-r--r-- | src/testdir/crash/reverse_text_overflow | bin | 0 -> 314 bytes | |||
| -rw-r--r-- | src/testdir/test_crash.vim | 9 | ||||
| -rw-r--r-- | src/version.c | 2 |
4 files changed, 12 insertions, 0 deletions
diff --git a/src/search.c b/src/search.c index 01c143f69b..e5936d8294 100644 --- a/src/search.c +++ b/src/search.c @@ -1548,6 +1548,7 @@ do_search( { vim_free(msgbuf); msgbuf = r; + msgbuflen = STRLEN(msgbuf); // move reversed text to beginning of buffer while (*r != NUL && *r == ' ') r++; diff --git a/src/testdir/crash/reverse_text_overflow b/src/testdir/crash/reverse_text_overflow Binary files differnew file mode 100644 index 0000000000..dfbfe2c9a6 --- /dev/null +++ b/src/testdir/crash/reverse_text_overflow diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim index 800f3e5e64..302d3730b6 100644 --- a/src/testdir/test_crash.vim +++ b/src/testdir/test_crash.vim @@ -150,6 +150,13 @@ func Test_crash1_2() \ ' ; echo "crash 4: [OK]" >> '.. result .. "\<cr>") call TermWait(buf, 150) + let file = 'crash/reverse_text_overflow' + let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'" + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' ; echo "crash 5: [OK]" >> '.. result .. "\<cr>") + call TermWait(buf, 150) + " clean up exe buf .. "bw!" exe "sp " .. result @@ -158,6 +165,7 @@ func Test_crash1_2() \ 'crash 2: [OK]', \ 'crash 3: [OK]', \ 'crash 4: [OK]', + \ 'crash 5: [OK]', \ ] call assert_equal(expected, getline(1, '$')) @@ -201,6 +209,7 @@ func Test_crash1_3() let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args) call TermWait(buf, 150) + call delete('Untitled') let file = 'crash/nullpointer' let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'\<cr>" diff --git a/src/version.c b/src/version.c index e77ef0f4c9..05ae6ca2ae 100644 --- a/src/version.c +++ b/src/version.c @@ -705,6 +705,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 689, +/**/ 688, /**/ 687, |