patch 9.0.1848: [security] buffer-overflow in vim_regsub_both()
Problem: buffer-overflow in vim_regsub_both()
Solution: Check remaining space
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 0dea3c2..445fe8d 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -6,7 +6,7 @@
func Test_crash1()
" The following used to crash Vim
- let opts = #{wait_for_ruler: 0}
+ let opts = #{wait_for_ruler: 0, rows: 20}
let args = ' -u NONE -i NONE -n -e -s -S '
let buf = RunVimInTerminal(args .. ' crash/poc_huaf1', opts)
call VerifyScreenDump(buf, 'Test_crash_01', {})
@@ -22,4 +22,13 @@
endfunc
+func Test_crash2()
+ " The following used to crash Vim
+ let opts = #{wait_for_ruler: 0, rows: 20}
+ let args = ' -u NONE -i NONE -n -e -s -S '
+ let buf = RunVimInTerminal(args .. ' crash/vim_regsub_both', opts)
+ call VerifyScreenDump(buf, 'Test_crash_01', {})
+ exe buf .. "bw!"
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab