Mercurial > vim
annotate vimtutor.bat @ 33865:8cdb69ea3711 v9.0.2143
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Commit: https://github.com/vim/vim/commit/abfa13ebe92d81aaf66669c428d767847b577453
Author: Christian Brabandt <cb@256bit.org>
Date: Thu Nov 30 11:32:18 2023 +0100
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Problem: [security]: buffer-overflow in ex_substitute
Solution: clear memory after allocating
When allocating the new_start pointer in ex_substitute() the memory
pointer points to some garbage that the following for loop in
ex_cmds.c:4743 confuses and causes it to accessing the new_start pointer
beyond it's size, leading to a buffer-overlow.
So fix this by using alloc_clear() instead of alloc(), which will
clear the memory by NUL and therefore cause the loop to terminate
correctly.
Reported by @henices, thanks!
closes: #13596
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 10 Dec 2023 15:16:05 +0100 |
| parents | 79aaaa134298 |
| children | 616de167c988 |
| rev | line source |
|---|---|
| 7 | 1 :: Start Vim on a copy of the tutor file. |
| 2 @echo off | |
| 3 | |
| 4 :: Usage: vimtutor [-console] [xx] | |
| 5 :: | |
| 6 :: -console means gvim will not be used | |
| 7 :: xx is a language code like "es" or "nl". | |
| 8 :: When an xx argument is given, it tries loading that tutor. | |
| 9 :: When this fails or no xx argument was given, it tries using 'v:lang' | |
| 10 :: When that also fails, it uses the English version. | |
| 11 | |
| 12 :: Use Vim to copy the tutor, it knows the value of $VIMRUNTIME | |
|
19711
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
13 FOR %%d in (. %TMP% %TEMP%) DO ( |
|
25812
79aaaa134298
patch 8.2.3441: MS-Windows: vimtutor can't handle path with spaces
Bram Moolenaar <Bram@vim.org>
parents:
25700
diff
changeset
|
14 call :test_dir_writable "%~dpf0" %%d |
|
19711
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
15 IF NOT ERRORLEVEL 1 GOTO dir_ok |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
16 ) |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
17 |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
18 echo No working directory is found |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
19 GOTO end |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
20 |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
21 :test_dir_writable |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
22 SET TUTORCOPY=%2\$tutor$ |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
23 COPY %1 %TUTORCOPY% >nul 2>nul |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
24 GOTO end |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
25 |
|
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
26 :dir_ok |
| 7 | 27 |
| 28 SET xx=%1 | |
| 29 | |
| 30 IF NOT .%1==.-console GOTO use_gui | |
| 31 SHIFT | |
| 32 SET xx=%1 | |
| 33 GOTO use_vim | |
| 34 :use_gui | |
| 35 | |
| 36 :: Try making a copy of tutor with gvim. If gvim cannot be found, try using | |
| 37 :: vim instead. If vim cannot be found, alert user to check environment and | |
| 38 :: installation. | |
| 39 | |
| 40 :: The script tutor.vim tells Vim which file to copy. | |
|
19711
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
41 start "dummy" /b /w "%~dp0gvim.exe" -u NONE -c "so $VIMRUNTIME/tutor/tutor.vim" |
| 7 | 42 IF ERRORLEVEL 1 GOTO use_vim |
| 43 | |
| 44 :: Start gvim without any .vimrc, set 'nocompatible' | |
|
19711
831a3f3be6f4
patch 8.2.0412: MS-Windows: cannot use vimtutor from the start menu
Bram Moolenaar <Bram@vim.org>
parents:
13113
diff
changeset
|
45 start "dummy" /b /w "%~dp0gvim.exe" -u NONE -c "set nocp" %TUTORCOPY% |
| 7 | 46 |
| 47 GOTO end | |
| 48 | |
| 49 :use_vim | |
| 50 :: The script tutor.vim tells Vim which file to copy | |
|
12485
ab40ecb0fd73
patch 8.0.1122: vimtutor.bat doesn't work well with vim.bat
Christian Brabandt <cb@256bit.org>
parents:
7
diff
changeset
|
51 call vim -u NONE -c "so $VIMRUNTIME/tutor/tutor.vim" |
| 7 | 52 IF ERRORLEVEL 1 GOTO no_executable |
| 53 | |
| 54 :: Start vim without any .vimrc, set 'nocompatible' | |
|
12485
ab40ecb0fd73
patch 8.0.1122: vimtutor.bat doesn't work well with vim.bat
Christian Brabandt <cb@256bit.org>
parents:
7
diff
changeset
|
55 call vim -u NONE -c "set nocp" %TUTORCOPY% |
| 7 | 56 |
| 57 GOTO end | |
| 58 | |
| 59 :no_executable | |
| 60 ECHO. | |
| 61 ECHO. | |
| 62 ECHO No vim or gvim found in current directory or PATH. | |
| 63 ECHO Check your installation or re-run install.exe | |
| 64 | |
| 65 :end | |
| 66 :: remove the copy of the tutor | |
| 67 IF EXIST %TUTORCOPY% DEL %TUTORCOPY% | |
| 68 SET xx= |