patch 9.1.0689: [security]: buffer-overflow in do_search() with 'rightleft'
Problem: buffer-overflow in do_search() with 'rightleft'
(SuyueGuo)
Solution: after reversing the text (which allocates a new buffer),
re-calculate the text length
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-v2x2-cjcg-f9jm
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/testdir/crash/reverse_text_overflow b/src/testdir/crash/reverse_text_overflow
new file mode 100644
index 0000000..dfbfe2c
--- /dev/null
+++ b/src/testdir/crash/reverse_text_overflow
Binary files differ
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 800f3e5..302d373 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -150,6 +150,13 @@
\ ' ; echo "crash 4: [OK]" >> '.. result .. "\<cr>")
call TermWait(buf, 150)
+ let file = 'crash/reverse_text_overflow'
+ let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
+ let args = printf(cmn_args, vim, file)
+ call term_sendkeys(buf, args ..
+ \ ' ; echo "crash 5: [OK]" >> '.. result .. "\<cr>")
+ call TermWait(buf, 150)
+
" clean up
exe buf .. "bw!"
exe "sp " .. result
@@ -158,6 +165,7 @@
\ 'crash 2: [OK]',
\ 'crash 3: [OK]',
\ 'crash 4: [OK]',
+ \ 'crash 5: [OK]',
\ ]
call assert_equal(expected, getline(1, '$'))
@@ -201,6 +209,7 @@
let args = printf(cmn_args, vim, file)
call term_sendkeys(buf, args)
call TermWait(buf, 150)
+ call delete('Untitled')
let file = 'crash/nullpointer'
let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'\<cr>"