diff options
| author | Christian Brabandt <cb@256bit.org> | 2023-09-03 21:24:33 +0200 |
|---|---|---|
| committer | Christian Brabandt <cb@256bit.org> | 2023-09-03 21:24:33 +0200 |
| commit | ee9166eb3b41846661a39b662dc7ebe8b5e15139 (patch) | |
| tree | 05f2a8a49b5a322d7f5d3840366e764ebcb7c0c5 /src/testdir | |
| parent | fc68299d436cf87453e432daa77b6d545df4d7ed (diff) | |
patch 9.0.1858: [security] heap use after free in ins_compl_get_exp()v9.0.1858
Problem: heap use after free in ins_compl_get_exp()
Solution: validate buffer before accessing it
Signed-off-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/testdir')
| -rw-r--r-- | src/testdir/crash/poc_tagfunc.vim | 6 | ||||
| -rw-r--r-- | src/testdir/test_crash.vim | 10 |
2 files changed, 14 insertions, 2 deletions
diff --git a/src/testdir/crash/poc_tagfunc.vim b/src/testdir/crash/poc_tagfunc.vim new file mode 100644 index 0000000000..49d9b6f719 --- /dev/null +++ b/src/testdir/crash/poc_tagfunc.vim @@ -0,0 +1,6 @@ +fu Tagfunc(t,f,o) + bw +endf +set tagfunc=Tagfunc +n0 +sil0norm0i diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim index 516d991939..27bf7b55d4 100644 --- a/src/testdir/test_crash.vim +++ b/src/testdir/test_crash.vim @@ -39,12 +39,17 @@ func Test_crash1() \ ' && echo "crash 4: [OK]" >> X_crash1_result.txt' .. "\<cr>") " clean up call delete('Xerr') - " This test takes a bit longer call TermWait(buf, 200) + let file = 'crash/poc_tagfunc.vim' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' || echo "crash 5: [OK]" >> X_crash1_result.txt' .. "\<cr>") + + call TermWait(buf, 100) + " clean up - call delete('Xerr') exe buf .. "bw!" sp X_crash1_result.txt @@ -54,6 +59,7 @@ func Test_crash1() \ 'crash 2: [OK]', \ 'crash 3: [OK]', \ 'crash 4: [OK]', + \ 'crash 5: [OK]', \ ] call assert_equal(expected, getline(1, '$')) |