patch 9.0.1857: [security] heap-use-after-free in is_qf_win()
Problem: heap-use-after-free in is_qf_win()
Solution: Check buffer is valid before accessing it
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index eb3c0a3..516d991 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -5,38 +5,58 @@
CheckScreendump
func Test_crash1()
+ if !executable('sh')
+ throw 'Skipped: sh not executable!'
+ endif
" The following used to crash Vim
- " let opts = #{wait_for_ruler: 0, rows: 20, cmd: 'sh'}
let opts = #{cmd: 'sh'}
- let args = 'bash'
let vim = GetVimProg()
- let buf = RunVimInTerminal(args, opts)
+ let buf = RunVimInTerminal('sh', opts)
let file = 'crash/poc_huaf1'
let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
let args = printf(cmn_args, vim, file)
call term_sendkeys(buf, args ..
- \ ' && echo "crash 1: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+ \ ' && echo "crash 1: [OK]" > X_crash1_result.txt' .. "\<cr>")
+ call TermWait(buf, 50)
let file = 'crash/poc_huaf2'
let args = printf(cmn_args, vim, file)
call term_sendkeys(buf, args ..
\ ' && echo "crash 2: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+ call TermWait(buf, 50)
let file = 'crash/poc_huaf3'
let args = printf(cmn_args, vim, file)
call term_sendkeys(buf, args ..
\ ' && echo "crash 3: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+ call TermWait(buf, 100)
- call TermWait(buf, 50)
+ let file = 'crash/bt_quickfix_poc'
+ let args = printf(cmn_args, vim, file)
+ call term_sendkeys(buf, args ..
+ \ ' && echo "crash 4: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+ " clean up
+ call delete('Xerr')
+
+ " This test takes a bit longer
+ call TermWait(buf, 200)
" clean up
+ call delete('Xerr')
exe buf .. "bw!"
sp X_crash1_result.txt
- call assert_equal(['crash 1: [OK]', 'crash 2: [OK]', 'crash 3: [OK]'],
- \ getline(1, '$'))
+
+ let expected = [
+ \ 'crash 1: [OK]',
+ \ 'crash 2: [OK]',
+ \ 'crash 3: [OK]',
+ \ 'crash 4: [OK]',
+ \ ]
+
+ call assert_equal(expected, getline(1, '$'))
bw!
call delete('X_crash1_result.txt')