mirror of
https://github.com/vim/vim.git
synced 2025-07-24 10:45:12 -04:00
patch 9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file
Problem: heap-buffer-overflow with 'nostartofline' and Ex command in tag file. Solution: Set cursor column when moving cursor to line 1 (zeertzjq). closes: #16796 Signed-off-by: zeertzjq <zeertzjq@outlook.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
parent
a95085e0fc
commit
3ed6659549
@ -3997,6 +3997,8 @@ jumpto_tag(
|
|||||||
++sandbox;
|
++sandbox;
|
||||||
#endif
|
#endif
|
||||||
curwin->w_cursor.lnum = 1; // start command in line 1
|
curwin->w_cursor.lnum = 1; // start command in line 1
|
||||||
|
curwin->w_cursor.col = 0;
|
||||||
|
curwin->w_cursor.coladd = 0;
|
||||||
do_cmdline_cmd(pbuf);
|
do_cmdline_cmd(pbuf);
|
||||||
retval = OK;
|
retval = OK;
|
||||||
|
|
||||||
|
@ -1633,4 +1633,21 @@ func Test_tag_guess_short()
|
|||||||
set tags& cpoptions-=t
|
set tags& cpoptions-=t
|
||||||
endfunc
|
endfunc
|
||||||
|
|
||||||
|
func Test_tag_excmd_with_nostartofline()
|
||||||
|
call writefile(["!_TAG_FILE_ENCODING\tutf-8\t//",
|
||||||
|
\ "f\tXfile\tascii"],
|
||||||
|
\ 'Xtags', 'D')
|
||||||
|
call writefile(['f', 'foobar'], 'Xfile', 'D')
|
||||||
|
|
||||||
|
set nostartofline
|
||||||
|
new Xfile
|
||||||
|
setlocal tags=Xtags
|
||||||
|
normal! G$
|
||||||
|
" This used to cause heap-buffer-overflow
|
||||||
|
tag f
|
||||||
|
|
||||||
|
bwipe!
|
||||||
|
set startofline&
|
||||||
|
endfunc
|
||||||
|
|
||||||
" vim: shiftwidth=2 sts=2 expandtab
|
" vim: shiftwidth=2 sts=2 expandtab
|
||||||
|
@ -704,6 +704,8 @@ static char *(features[]) =
|
|||||||
|
|
||||||
static int included_patches[] =
|
static int included_patches[] =
|
||||||
{ /* Add new patch number below this line */
|
{ /* Add new patch number below this line */
|
||||||
|
/**/
|
||||||
|
1172,
|
||||||
/**/
|
/**/
|
||||||
1171,
|
1171,
|
||||||
/**/
|
/**/
|
||||||
|
Loading…
x
Reference in New Issue
Block a user