From f6d28fe2c95c678cc3202cc5dc825a3fcc709e93 Mon Sep 17 00:00:00 2001 From: Christian Brabandt Date: Tue, 5 Sep 2023 20:18:06 +0200 Subject: patch 9.0.1873: [security] heap-buffer-overflow in vim_regsub_both Problem: heap-buffer-overflow in vim_regsub_both Solution: Disallow exchanging windows when textlock is active Signed-off-by: Christian Brabandt --- src/ex_cmds.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src/ex_cmds.c') diff --git a/src/ex_cmds.c b/src/ex_cmds.c index 4f1d93244f..566ed7dad3 100644 --- a/src/ex_cmds.c +++ b/src/ex_cmds.c @@ -4519,6 +4519,9 @@ ex_substitute(exarg_T *eap) { nmatch = curbuf->b_ml.ml_line_count - sub_firstlnum + 1; skip_match = TRUE; + // safety check + if (nmatch < 0) + goto skip; } // Need room for: -- cgit v1.2.3