diff options
| author | John Marriott <basilisk@internode.on.net> | 2024-09-21 11:39:02 +0200 |
|---|---|---|
| committer | Christian Brabandt <cb@256bit.org> | 2024-09-21 11:39:02 +0200 |
| commit | a6de28755ec3fcc86d1ed0b744f1b410a8e9702d (patch) | |
| tree | ced629afe51478fb00f562a5b95882efade87884 | |
| parent | a0c14ef310acac62276b4ee51930d3246b11772e (diff) | |
patch 9.1.0739: [security]: use-after-free in ex_getln.cv9.1.0739
Problem: [security]: use-after-free in ex_getln.c
Solution: free pointer p a bit later (John Marriott)
closes: #15712
Signed-off-by: John Marriott <basilisk@internode.on.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>
| -rw-r--r-- | src/ex_getln.c | 3 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/src/ex_getln.c b/src/ex_getln.c index 1b3a699a21..b4c7941013 100644 --- a/src/ex_getln.c +++ b/src/ex_getln.c @@ -3330,7 +3330,6 @@ realloc_cmdbuff(int len) // there, thus copy up to the NUL and add a NUL. mch_memmove(ccline.cmdbuff, p, (size_t)ccline.cmdlen); ccline.cmdbuff[ccline.cmdlen] = NUL; - vim_free(p); if (ccline.xpc != NULL && ccline.xpc->xp_pattern != NULL @@ -3345,6 +3344,8 @@ realloc_cmdbuff(int len) ccline.xpc->xp_pattern = ccline.cmdbuff + i; } + vim_free(p); + return OK; } diff --git a/src/version.c b/src/version.c index ff2b77f0f1..f4b7554711 100644 --- a/src/version.c +++ b/src/version.c @@ -705,6 +705,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 739, +/**/ 738, /**/ 737, |