aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-07-26 11:04:33 -04:00
Code

patch 9.0.1840: [security] use-after-free in do_ecmd

Browse Source 
Problem:  use-after-free in do_ecmd
Solution: Verify oldwin pointer after reset_VIsual()

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt 2023-09-02 14:40:13 +02:00
parent acb91d3905
commit e1dc9a6275
No known key found for this signature in database
GPG Key ID: F3F92DA383FDDE09
8 changed files with 59 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/ex_cmds.c
View File

@ -2646,12 +2646,18 @@ do_ecmd(
goto theend;
}
/*
* End Visual mode before switching to another buffer, so the text can be
* copied into the GUI selection buffer.
*/
// End Visual mode before switching to another buffer, so the text can be
// copied into the GUI selection buffer.
// Careful: may trigger ModeChanged() autocommand
// Should we block autocommands here?
reset_VIsual();
// autocommands freed window :(
if (oldwin != NULL && !win_valid(oldwin))
oldwin = NULL;
#if defined(FEAT_EVAL)
if ((command != NULL || newlnum > (linenr_T)0)
&& *get_vim_var_str(VV_SWAPCOMMAND) == NUL)

2
src/testdir/Make_all.mak
View File

@ -105,6 +105,7 @@ NEW_TESTS = \
test_conceal \
test_const \
test_cpoptions \
test_crash \
test_crypt \
test_cscope \
test_cursor_func \
@ -369,6 +370,7 @@ NEW_TESTS_RES = \
test_conceal.res \
test_const.res \
test_cpoptions.res \
test_crash.res \
test_crypt.res \
test_cscope.res \
test_cursor_func.res \

BIN
src/testdir/crash/poc_huaf1 Normal file
View File

Binary file not shown.

BIN
src/testdir/crash/poc_huaf2 Normal file
View File

Binary file not shown.

BIN
src/testdir/crash/poc_huaf3 Normal file
View File

Binary file not shown.

20
src/testdir/dumps/Test_crash_01.dump Normal file
View File

@ -0,0 +1,20 @@
> +0&#ffffff0@74
@75
@75
@75
@75
@75
@75
@75
@75
@75
@75
@75
@75
@75
@75
@75
@75
@75
@75
@75

25
src/testdir/test_crash.vim Normal file
View File

@ -0,0 +1,25 @@
" Some tests, that used to crash Vim
source check.vim
source screendump.vim
CheckScreendump
func Test_crash1()
" The following used to crash Vim
let opts = #{wait_for_ruler: 0}
let args = ' -u NONE -i NONE -n -e -s -S '
let buf = RunVimInTerminal(args .. ' crash/poc_huaf1', opts)
call VerifyScreenDump(buf, 'Test_crash_01', {})
exe buf .. "bw!"
let buf = RunVimInTerminal(args .. ' crash/poc_huaf2', opts)
call VerifyScreenDump(buf, 'Test_crash_01', {})
exe buf .. "bw!"
let buf = RunVimInTerminal(args .. ' crash/poc_huaf3', opts)
call VerifyScreenDump(buf, 'Test_crash_01', {})
exe buf .. "bw!"
endfunc
" vim: shiftwidth=2 sts=2 expandtab

2
src/version.c
View File

@ -699,6 +699,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
1840,
/**/
1839,
/**/