commit ced2c7394aafdc90fb7845e09b3a3fee23d48cb1
author Christian Brabandt <cb@256bit.org> Sat Sep 02 21:15:52 2023 +0200
committer Christian Brabandt <cb@256bit.org> Sat Sep 02 21:37:04 2023 +0200
tree 9576ca9f0aa1d127ed8d06821375b6d2de50fd5a
parent 889f6af37164775192e33b233a90e86fd3df0f57

patch 9.0.1848: [security] buffer-overflow in vim_regsub_both()

Problem:  buffer-overflow in vim_regsub_both()
Solution: Check remaining space

Signed-off-by: Christian Brabandt <cb@256bit.org>

src/testdir/crash/vim_regsub_both

diff --git a/src/testdir/crash/vim_regsub_both b/src/testdir/crash/vim_regsub_both
new file mode 100644
index 0000000..a82b205
--- /dev/null
+++ b/src/testdir/crash/vim_regsub_both
@@ -0,0 +1,10 @@
+fu R()
+sil!norm0z=
+endf
+cal R()
+s/\%')/\=R()
+d
+no0 normyynore sm:vs0@vvvvvvvvvvse()dir(¼Xtest=csd{so88
+vs
+0scr
+so

src/testdir/test_crash.vim

diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 0dea3c2..445fe8d 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -6,7 +6,7 @@
 
 func Test_crash1()
   " The following used to crash Vim
-  let opts = #{wait_for_ruler: 0}
+  let opts = #{wait_for_ruler: 0, rows: 20}
   let args = ' -u NONE -i NONE -n -e -s -S '
   let buf = RunVimInTerminal(args .. ' crash/poc_huaf1', opts)
   call VerifyScreenDump(buf, 'Test_crash_01', {})
@@ -22,4 +22,13 @@
 
 endfunc
 
+func Test_crash2()
+  " The following used to crash Vim
+  let opts = #{wait_for_ruler: 0, rows: 20}
+  let args = ' -u NONE -i NONE -n -e -s -S '
+  let buf = RunVimInTerminal(args .. ' crash/vim_regsub_both', opts)
+  call VerifyScreenDump(buf, 'Test_crash_01', {})
+  exe buf .. "bw!"
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab