aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-07-26 11:04:33 -04:00
Code

patch 9.1.0648: [security] double-free in dialog_changed()

Browse Source 
Problem:  [security] double-free in dialog_changed()
          (SuyueGuo)
Solution: Only clear pointer b_sfname pointer, if it is different
          than the b_ffname pointer.  Don't try to free b_fname,
          set it to NULL instead.

fixes: #15403

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt 2024-08-01 22:10:28 +02:00
parent 8a0bbe7b8a
commit b29f4abcd4
No known key found for this signature in database
GPG Key ID: F3F92DA383FDDE09
4 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/ex_cmds2.c
View File

@ -197,9 +197,11 @@ dialog_changed(
// restore to empty when write failed
if (empty_bufname)
{
VIM_CLEAR(buf->b_fname);
// prevent double free
if (buf->b_sfname != buf->b_ffname)
VIM_CLEAR(buf->b_sfname);
buf->b_fname = NULL;
VIM_CLEAR(buf->b_ffname);
VIM_CLEAR(buf->b_sfname);
unchanged(buf, TRUE, FALSE);
}
}

BIN
src/testdir/crash/dialog_changed_uaf Normal file
View File

Binary file not shown.

6
src/testdir/test_crash.vim
View File

@ -196,6 +196,12 @@ func Test_crash1_3()
call term_sendkeys(buf, args)
call TermWait(buf, 50)
let file = 'crash/dialog_changed_uaf'
let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'\<cr>"
let args = printf(cmn_args, vim, file)
call term_sendkeys(buf, args)
call TermWait(buf, 150)
" clean up
exe buf .. "bw!"
bw!

2
src/version.c
View File

@ -704,6 +704,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
648,
/**/
647,
/**/