Mercurial > vim
annotate vimtutor.bat @ 33811:06219b3bdaf3 v9.0.2121
patch 9.0.2121: [security]: use-after-free in ex_substitute
Commit: https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb
Author: Christian Brabandt <cb@256bit.org>
Date: Wed Nov 22 21:26:41 2023 +0100
patch 9.0.2121: [security]: use-after-free in ex_substitute
Problem: [security]: use-after-free in ex_substitute
Solution: always allocate memory
closes: #13552
A recursive :substitute command could cause a heap-use-after free in Vim
(CVE-2023-48706).
The whole reproducible test is a bit tricky, I can only reproduce this
reliably when no previous substitution command has been used yet
(which is the reason, the test needs to run as first one in the
test_substitute.vim file) and as a combination of the `:~` command
together with a :s command that contains the special substitution atom `~\=`
which will make use of a sub-replace special atom and calls a vim script
function.
There was a comment in the existing :s code, that already makes the
`sub` variable allocate memory so that a recursive :s call won't be able
to cause any issues here, so this was known as a potential problem
already. But for the current test-case that one does not work, because
the substitution does not start with `\=` but with `~\=` (and since
there does not yet exist a previous substitution atom, Vim will simply
increment the `sub` pointer (which then was not allocated dynamically)
and later one happily use a sub-replace special expression (which could
then free the `sub` var).
The following commit fixes this, by making the sub var always using
allocated memory, which also means we need to free the pointer whenever
we leave the function. Since sub is now always an allocated variable,
we also do no longer need the sub_copy variable anymore, since this one
was used to indicated when sub pointed to allocated memory (and had
therefore to be freed on exit) and when not.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q
Signed-off-by: Christian Brabandt <cb@256bit.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Wed, 22 Nov 2023 22:15:05 +0100 |
parents | 79aaaa134298 |
children |
rev | line source |
---|---|
7 | 1 :: Start Vim on a copy of the tutor file. |
2 @echo off | |
3 | |
4 :: Usage: vimtutor [-console] [xx] | |
5 :: | |
6 :: -console means gvim will not be used | |
7 :: xx is a language code like "es" or "nl". | |
8 :: When an xx argument is given, it tries loading that tutor. | |
9 :: When this fails or no xx argument was given, it tries using 'v:lang' | |
10 :: When that also fails, it uses the English version. | |
11 | |
12 :: Use Vim to copy the tutor, it knows the value of $VIMRUNTIME | |
19711
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
13 FOR %%d in (. %TMP% %TEMP%) DO ( |
25812
79aaaa134298
patch 8.2.3441: MS-Windows: vimtutor can't handle path with spaces
Bram Moolenaar <Bram@vim.org>
parents:
25700
diff
changeset
|
14 call :test_dir_writable "%~dpf0" %%d |
19711
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
15 IF NOT ERRORLEVEL 1 GOTO dir_ok |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
16 ) |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
17 |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
18 echo No working directory is found |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
19 GOTO end |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
20 |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
21 :test_dir_writable |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
22 SET TUTORCOPY=%2\$tutor$ |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
23 COPY %1 %TUTORCOPY% >nul 2>nul |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
24 GOTO end |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
25 |
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
26 :dir_ok |
7 | 27 |
28 SET xx=%1 | |
29 | |
30 IF NOT .%1==.-console GOTO use_gui | |
31 SHIFT | |
32 SET xx=%1 | |
33 GOTO use_vim | |
34 :use_gui | |
35 | |
36 :: Try making a copy of tutor with gvim. If gvim cannot be found, try using | |
37 :: vim instead. If vim cannot be found, alert user to check environment and | |
38 :: installation. | |
39 | |
40 :: The script tutor.vim tells Vim which file to copy. | |
19711
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
41 start "dummy" /b /w "%~dp0gvim.exe" -u NONE -c "so $VIMRUNTIME/tutor/tutor.vim" |
7 | 42 IF ERRORLEVEL 1 GOTO use_vim |
43 | |
44 :: Start gvim without any .vimrc, set 'nocompatible' | |
19711
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
45 start "dummy" /b /w "%~dp0gvim.exe" -u NONE -c "set nocp" %TUTORCOPY% |
7 | 46 |
47 GOTO end | |
48 | |
49 :use_vim | |
50 :: The script tutor.vim tells Vim which file to copy | |
12485
ab40ecb0fd73
patch 8.0.1122: vimtutor.bat doesn't work well with vim.bat
Christian Brabandt <cb@256bit.org>
parents:
7
diff
changeset
|
51 call vim -u NONE -c "so $VIMRUNTIME/tutor/tutor.vim" |
7 | 52 IF ERRORLEVEL 1 GOTO no_executable |
53 | |
54 :: Start vim without any .vimrc, set 'nocompatible' | |
12485
ab40ecb0fd73
patch 8.0.1122: vimtutor.bat doesn't work well with vim.bat
Christian Brabandt <cb@256bit.org>
parents:
7
diff
changeset
|
55 call vim -u NONE -c "set nocp" %TUTORCOPY% |
7 | 56 |
57 GOTO end | |
58 | |
59 :no_executable | |
60 ECHO. | |
61 ECHO. | |
62 ECHO No vim or gvim found in current directory or PATH. | |
63 ECHO Check your installation or re-run install.exe | |
64 | |
65 :end | |
66 :: remove the copy of the tutor | |
67 IF EXIST %TUTORCOPY% DEL %TUTORCOPY% | |
68 SET xx= |