patch 9.0.1873: [security] heap-buffer-overflow in vim_regsub_both
Problem: heap-buffer-overflow in vim_regsub_both
Solution: Disallow exchanging windows when textlock is active
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/testdir/crash/vim_regsub_both_poc b/src/testdir/crash/vim_regsub_both_poc
new file mode 100644
index 0000000..19a5711
--- /dev/null
+++ b/src/testdir/crash/vim_regsub_both_poc
Binary files differ
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index e0884e5..f7b528c 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -46,6 +46,7 @@
let file = 'crash/poc_tagfunc.vim'
let args = printf(cmn_args, vim, file)
+ " using || because this poc causes vim to exit with exitstatus != 0
call term_sendkeys(buf, args ..
\ ' || echo "crash 5: [OK]" >> X_crash1_result.txt' .. "\<cr>")
@@ -59,6 +60,13 @@
call delete('X')
call TermWait(buf, 3000)
+ let file = 'crash/vim_regsub_both_poc'
+ let args = printf(cmn_args, vim, file)
+ " using || because this poc causes vim to exit with exitstatus != 0
+ call term_sendkeys(buf, args ..
+ \ ' && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+ call TermWait(buf, 1000)
+
" clean up
exe buf .. "bw!"
@@ -71,6 +79,7 @@
\ 'crash 4: [OK]',
\ 'crash 5: [OK]',
\ 'crash 6: [OK]',
+ \ 'crash 7: [OK]',
\ ]
call assert_equal(expected, getline(1, '$'))