From 3ed6659549e447ff00def8edc841321e497f70a8 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Wed, 5 Mar 2025 20:05:18 +0100 Subject: [PATCH] patch 9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file Problem: heap-buffer-overflow with 'nostartofline' and Ex command in tag file. Solution: Set cursor column when moving cursor to line 1 (zeertzjq). closes: #16796 Signed-off-by: zeertzjq Signed-off-by: Christian Brabandt --- src/tag.c | 2 ++ src/testdir/test_tagjump.vim | 17 +++++++++++++++++ src/version.c | 2 ++ 3 files changed, 21 insertions(+) diff --git a/src/tag.c b/src/tag.c index 21ff5636ac..f61f116744 100644 --- a/src/tag.c +++ b/src/tag.c @@ -3997,6 +3997,8 @@ jumpto_tag( ++sandbox; #endif curwin->w_cursor.lnum = 1; // start command in line 1 + curwin->w_cursor.col = 0; + curwin->w_cursor.coladd = 0; do_cmdline_cmd(pbuf); retval = OK; diff --git a/src/testdir/test_tagjump.vim b/src/testdir/test_tagjump.vim index 67bd95fe11..e4b258c57a 100644 --- a/src/testdir/test_tagjump.vim +++ b/src/testdir/test_tagjump.vim @@ -1633,4 +1633,21 @@ func Test_tag_guess_short() set tags& cpoptions-=t endfunc +func Test_tag_excmd_with_nostartofline() + call writefile(["!_TAG_FILE_ENCODING\tutf-8\t//", + \ "f\tXfile\tascii"], + \ 'Xtags', 'D') + call writefile(['f', 'foobar'], 'Xfile', 'D') + + set nostartofline + new Xfile + setlocal tags=Xtags + normal! G$ + " This used to cause heap-buffer-overflow + tag f + + bwipe! + set startofline& +endfunc + " vim: shiftwidth=2 sts=2 expandtab diff --git a/src/version.c b/src/version.c index aac7ed1aeb..cfb661e706 100644 --- a/src/version.c +++ b/src/version.c @@ -704,6 +704,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 1172, /**/ 1171, /**/