Mercurial > vim

comparison src/ex_cmds.c @ 33865:8cdb69ea3711 v9.0.2143

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 9.0.2143: [security]: buffer-overflow in ex_substitute Commit: https://github.com/vim/vim/commit/abfa13ebe92d81aaf66669c428d767847b577453 Author: Christian Brabandt <cb@256bit.org> Date: Thu Nov 30 11:32:18 2023 +0100 patch 9.0.2143: [security]: buffer-overflow in ex_substitute Problem: [security]: buffer-overflow in ex_substitute Solution: clear memory after allocating When allocating the new_start pointer in ex_substitute() the memory pointer points to some garbage that the following for loop in ex_cmds.c:4743 confuses and causes it to accessing the new_start pointer beyond it's size, leading to a buffer-overlow. So fix this by using alloc_clear() instead of alloc(), which will clear the memory by NUL and therefore cause the loop to terminate correctly. Reported by @henices, thanks! closes: #13596 Signed-off-by: Christian Brabandt <cb@256bit.org>
author Christian Brabandt <cb@256bit.org>
date Sun, 10 Dec 2023 15:16:05 +0100
parents 06219b3bdaf3
children 7c30841c60a0
comparison
equal deleted inserted replaced
33864:6e4c686b6b5b 33865:8cdb69ea3711
4648 * Get some space for a temporary buffer to do the 4648 * Get some space for a temporary buffer to do the
4649 * substitution into (and some extra space to avoid 4649 * substitution into (and some extra space to avoid
4650 * too many calls to alloc()/free()). 4650 * too many calls to alloc()/free()).
4651 */ 4651 */
4652 new_start_len = needed_len + 50; 4652 new_start_len = needed_len + 50;
4653 if ((new_start = alloc(new_start_len)) == NULL) 4653 if ((new_start = alloc_clear(new_start_len)) == NULL)
4654 goto outofmem; 4654 goto outofmem;
4655 *new_start = NUL; 4655 *new_start = NUL;
4656 new_end = new_start; 4656 new_end = new_start;
4657 } 4657 }
4658 else 4658 else
4665 len = (unsigned)STRLEN(new_start); 4665 len = (unsigned)STRLEN(new_start);
4666 needed_len += len; 4666 needed_len += len;
4667 if (needed_len > (int)new_start_len) 4667 if (needed_len > (int)new_start_len)
4668 { 4668 {
4669 new_start_len = needed_len + 50; 4669 new_start_len = needed_len + 50;
4670 if ((p1 = alloc(new_start_len)) == NULL) 4670 if ((p1 = alloc_clear(new_start_len)) == NULL)
4671 { 4671 {
4672 vim_free(new_start); 4672 vim_free(new_start);
4673 goto outofmem; 4673 goto outofmem;
4674 } 4674 }
4675 mch_memmove(p1, new_start, (size_t)(len + 1)); 4675 mch_memmove(p1, new_start, (size_t)(len + 1));