aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-07-26 11:04:33 -04:00
Code

patch 9.0.1848: [security] buffer-overflow in vim_regsub_both()

Browse Source 
Problem:  buffer-overflow in vim_regsub_both()
Solution: Check remaining space

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt 2023-09-02 21:15:52 +02:00
parent 889f6af371
commit ced2c7394a
No known key found for this signature in database
GPG Key ID: F3F92DA383FDDE09
5 changed files with 27 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/ex_cmds.c
View File

@ -4651,6 +4651,9 @@ ex_substitute(exarg_T *eap)
mch_memmove(new_end, sub_firstline + copycol, (size_t)copy_len);
new_end += copy_len;
if (new_start_len - copy_len < sublen)
sublen = new_start_len - copy_len - 1;
#ifdef FEAT_EVAL
++textlock;
#endif

3
src/regexp.c
View File

@ -2051,7 +2051,8 @@ vim_regsub_both(
// "flags & REGSUB_COPY" != 0.
if (copy)
{
if (eval_result[nested] != NULL)
if (eval_result[nested] != NULL &&
STRLEN(eval_result[nested]) < destlen)
{
STRCPY(dest, eval_result[nested]);
dst += STRLEN(eval_result[nested]);

10
src/testdir/crash/vim_regsub_both Normal file
View File

@ -0,0 +1,10 @@
fu R()
sil!norm0z=
endf
cal R()
s/\%')/\=R()
d
no0 normyynore sm:vs0@vvvvvvvvvvse()dir(¼Xtest=csd{so88
vs
0scr
so

11
src/testdir/test_crash.vim
View File

@ -6,7 +6,7 @@ CheckScreendump
func Test_crash1()
" The following used to crash Vim
let opts = #{wait_for_ruler: 0}
let opts = #{wait_for_ruler: 0, rows: 20}
let args = ' -u NONE -i NONE -n -e -s -S '
let buf = RunVimInTerminal(args .. ' crash/poc_huaf1', opts)
call VerifyScreenDump(buf, 'Test_crash_01', {})
@ -22,4 +22,13 @@ func Test_crash1()
endfunc
func Test_crash2()
" The following used to crash Vim
let opts = #{wait_for_ruler: 0, rows: 20}
let args = ' -u NONE -i NONE -n -e -s -S '
let buf = RunVimInTerminal(args .. ' crash/vim_regsub_both', opts)
call VerifyScreenDump(buf, 'Test_crash_01', {})
exe buf .. "bw!"
endfunc
" vim: shiftwidth=2 sts=2 expandtab

2
src/version.c
View File

@ -699,6 +699,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
1848,
/**/
1847,
/**/