diff options
| author | Christian Brabandt <cb@256bit.org> | 2024-08-25 21:33:03 +0200 |
|---|---|---|
| committer | Christian Brabandt <cb@256bit.org> | 2024-08-25 21:33:03 +0200 |
| commit | 322ba9108612bead5eb7731ccb66763dec69ef1b (patch) | |
| tree | 719540ebb6d96126934dedb746009c1cb98bde0f | |
| parent | 663950d700f496c1db09307253e6b1b2a56140d5 (diff) | |
patch 9.1.0697: [security]: heap-buffer-overflow in ins_typebufv9.1.0697
Problem: heap-buffer-overflow in ins_typebuf
(SuyueGuo)
Solution: When flushing the typeahead buffer, validate that there
is enough space left
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh
Signed-off-by: Christian Brabandt <cb@256bit.org>
| -rw-r--r-- | src/getchar.c | 15 | ||||
| -rw-r--r-- | src/testdir/crash/heap_overflow3 | bin | 0 -> 700 bytes | |||
| -rw-r--r-- | src/testdir/test_crash.vim | 7 | ||||
| -rw-r--r-- | src/version.c | 2 |
4 files changed, 21 insertions, 3 deletions
diff --git a/src/getchar.c b/src/getchar.c index 29323fa328..96e180f4ae 100644 --- a/src/getchar.c +++ b/src/getchar.c @@ -446,9 +446,18 @@ flush_buffers(flush_buffers_T flush_typeahead) if (flush_typeahead == FLUSH_MINIMAL) { - // remove mapped characters at the start only - typebuf.tb_off += typebuf.tb_maplen; - typebuf.tb_len -= typebuf.tb_maplen; + // remove mapped characters at the start only, + // but only when enough space left in typebuf + if (typebuf.tb_off + typebuf.tb_maplen >= typebuf.tb_buflen) + { + typebuf.tb_off = MAXMAPLEN; + typebuf.tb_len = 0; + } + else + { + typebuf.tb_off += typebuf.tb_maplen; + typebuf.tb_len -= typebuf.tb_maplen; + } #if defined(FEAT_CLIENTSERVER) || defined(FEAT_EVAL) if (typebuf.tb_len == 0) typebuf_was_filled = FALSE; diff --git a/src/testdir/crash/heap_overflow3 b/src/testdir/crash/heap_overflow3 Binary files differnew file mode 100644 index 0000000000..c40adbec4d --- /dev/null +++ b/src/testdir/crash/heap_overflow3 diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim index f1843c4266..5ec103f6db 100644 --- a/src/testdir/test_crash.vim +++ b/src/testdir/test_crash.vim @@ -216,6 +216,13 @@ func Test_crash1_3() call term_sendkeys(buf, args) call TermWait(buf, 50) + let file = 'crash/heap_overflow3' + let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'" + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args) + call TermWait(buf, 150) + + " clean up exe buf .. "bw!" bw! diff --git a/src/version.c b/src/version.c index b07964e2d7..7f88c8c683 100644 --- a/src/version.c +++ b/src/version.c @@ -705,6 +705,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 697, +/**/ 696, /**/ 695, |