patch 9.1.0707: [security]: invalid cursor position may cause a crash
Problem: [security]: invalid cursor position may cause a crash
(after v9.1.0038)
Solution: Set cursor to the last character in a line, if it would
otherwise point to beyond the line; no tests added, as it
is unclear how to reproduce this.
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh
Co-authored-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/charset.c b/src/charset.c
index 19b0895..399f258 100644
--- a/src/charset.c
+++ b/src/charset.c
@@ -1678,6 +1678,9 @@
}
clear_chartabsize_arg(&cts);
+ if (*ptr == NUL && pos->col < MAXCOL && pos->col > ptr - line)
+ pos->col = ptr - line;
+
if (start != NULL)
*start = vcol + head;
if (end != NULL)