Mercurial > vim
view src/testdir/screendump.vim @ 33811:06219b3bdaf3 v9.0.2121
patch 9.0.2121: [security]: use-after-free in ex_substitute
Commit: https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb
Author: Christian Brabandt <cb@256bit.org>
Date: Wed Nov 22 21:26:41 2023 +0100
patch 9.0.2121: [security]: use-after-free in ex_substitute
Problem: [security]: use-after-free in ex_substitute
Solution: always allocate memory
closes: #13552
A recursive :substitute command could cause a heap-use-after free in Vim
(CVE-2023-48706).
The whole reproducible test is a bit tricky, I can only reproduce this
reliably when no previous substitution command has been used yet
(which is the reason, the test needs to run as first one in the
test_substitute.vim file) and as a combination of the `:~` command
together with a :s command that contains the special substitution atom `~\=`
which will make use of a sub-replace special atom and calls a vim script
function.
There was a comment in the existing :s code, that already makes the
`sub` variable allocate memory so that a recursive :s call won't be able
to cause any issues here, so this was known as a potential problem
already. But for the current test-case that one does not work, because
the substitution does not start with `\=` but with `~\=` (and since
there does not yet exist a previous substitution atom, Vim will simply
increment the `sub` pointer (which then was not allocated dynamically)
and later one happily use a sub-replace special expression (which could
then free the `sub` var).
The following commit fixes this, by making the sub var always using
allocated memory, which also means we need to free the pointer whenever
we leave the function. Since sub is now always an allocated variable,
we also do no longer need the sub_copy variable anymore, since this one
was used to indicated when sub pointed to allocated memory (and had
therefore to be freed on exit) and when not.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q
Signed-off-by: Christian Brabandt <cb@256bit.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Wed, 22 Nov 2023 22:15:05 +0100 |
parents | 4a88061200c2 |
children |
line wrap: on
line source
" Functions shared by tests making screen dumps. " Only load this script once. if exists('*VerifyScreenDump') finish endif source shared.vim source term_util.vim " Skip the rest if there is no terminal feature at all. if !has('terminal') finish endif " Read a dump file "fname" and if "filter" exists apply it to the text. def ReadAndFilter(fname: string, filter: string): list<string> var contents = readfile(fname) if filereadable(filter) # do this in the bottom window so that the terminal window is unaffected wincmd j enew setline(1, contents) exe "source " .. filter contents = getline(1, '$') enew! wincmd k redraw endif return contents enddef " Verify that Vim running in terminal buffer "buf" matches the screen dump. " "options" is passed to term_dumpwrite(). " Additionally, the "wait" entry can specify the maximum time to wait for the " screen dump to match in msec (default 1000 msec). " The file name used is "dumps/{filename}.dump". " " To ignore part of the dump, provide a "dumps/{filename}.vim" file with " Vim commands to be applied to both the reference and the current dump, so " that parts that are irrelevant are not used for the comparison. The result " is NOT written, thus "term_dumpdiff()" shows the difference anyway. " " Optionally an extra argument can be passed which is prepended to the error " message. Use this when using the same dump file with different options. " Returns non-zero when verification fails. func VerifyScreenDump(buf, filename, options, ...) let reference = 'dumps/' . a:filename . '.dump' let filter = 'dumps/' . a:filename . '.vim' let testfile = 'failed/' . a:filename . '.dump' let max_loops = get(a:options, 'wait', 1000) / 10 " Starting a terminal to make a screendump is always considered flaky. let g:test_is_flaky = 1 " wait for the pending updates to be handled. call TermWait(a:buf) " Redraw to execute the code that updates the screen. Otherwise we get the " text and attributes only from the internal buffer. redraw if filereadable(reference) let refdump = ReadAndFilter(reference, filter) else " Must be a new screendump, always fail let refdump = [] endif let did_mkdir = 0 if !isdirectory('failed') let did_mkdir = 1 call mkdir('failed') endif let i = 0 while 1 " leave some time for updating the original window sleep 10m call delete(testfile) call term_dumpwrite(a:buf, testfile, a:options) let testdump = ReadAndFilter(testfile, filter) if refdump == testdump call delete(testfile) if did_mkdir call delete('failed', 'd') endif break endif if i == max_loops " Leave the failed dump around for inspection. if filereadable(reference) let msg = 'See dump file difference: call term_dumpdiff("testdir/' .. testfile .. '", "testdir/' .. reference .. '")' if a:0 == 1 let msg = a:1 . ': ' . msg endif if len(testdump) != len(refdump) let msg = msg . '; line count is ' . len(testdump) . ' instead of ' . len(refdump) endif else let msg = 'See new dump file: call term_dumpload("testdir/' .. testfile .. '")' " no point in retrying let g:run_nr = 10 endif for i in range(len(refdump)) if i >= len(testdump) break endif if testdump[i] != refdump[i] let msg = msg . '; difference in line ' . (i + 1) . ': "' . testdump[i] . '"' endif endfor call assert_report(msg) return 1 endif let i += 1 endwhile return 0 endfunc