Mercurial > vim
changeset 35873:3e2f18adac4a v9.1.0648
patch 9.1.0648: [security] double-free in dialog_changed()
Commit: https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60
Author: Christian Brabandt <cb@256bit.org>
Date: Thu Aug 1 22:10:28 2024 +0200
patch 9.1.0648: [security] double-free in dialog_changed()
Problem: [security] double-free in dialog_changed()
(SuyueGuo)
Solution: Only clear pointer b_sfname pointer, if it is different
than the b_ffname pointer. Don't try to free b_fname,
set it to NULL instead.
fixes: #15403
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Thu, 01 Aug 2024 22:45:08 +0200 |
| parents | ba09f6d684f4 |
| children | d6db0423a54b |
| files | src/ex_cmds2.c src/testdir/crash/dialog_changed_uaf src/testdir/test_crash.vim src/version.c |
| diffstat | 4 files changed, 12 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/src/ex_cmds2.c +++ b/src/ex_cmds2.c @@ -197,9 +197,11 @@ dialog_changed( // restore to empty when write failed if (empty_bufname) { - VIM_CLEAR(buf->b_fname); + // prevent double free + if (buf->b_sfname != buf->b_ffname) + VIM_CLEAR(buf->b_sfname); + buf->b_fname = NULL; VIM_CLEAR(buf->b_ffname); - VIM_CLEAR(buf->b_sfname); unchanged(buf, TRUE, FALSE); } }
new file mode 100644 index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..e37d18d6daca107697bd19934b34054aa09e48a4 GIT binary patch literal 552 zc$|HZ!A{gb7=ZsSVA4N<B{3lzPeW6)o32GS;$lijP<BHgK%>z`lOEb_XQfzXmQI(h zB_W$|Q|}&p0gqgG09c>IH^2vQY{3M*_+2KMf0FsW-;3+@IuRCkT?KsheM9>PYxf3_ zKdV@O^#&P_54@<-*s*MNE}G?)x#?mw9{(6$b6}b#>1NrtU6y5b+qTba+up+U*Bj5* zZ|@@?Q-P6y0s?@8#+s@sOG}Kgea4(x;&lZ!-L@7lBMo1${9g#LG?KD<f=@b~&S0J> zuw8H-;*^wAh<J1?j^9}XyD8ED%^nu2<=dpizsv64901W*1zPFa=ccnq$%OwjWP_oH z4;sRc31pO@;7Dt;tJHN(lZ8VoaB4!1*kc%d$d_?1d1yQ{8&SDjDkI;@-;ma2({(ij z><Yu6XlP#oGOy&Jf?a6rk>jAC3GsU{vnl$h4~CQoGC31~URzjbO#<y3Do?|7F-$1q zJs!Wmug4A^BK(q4PG14gVLz7x4;*A4<NxhEs_YzE_MI#{%~p!Sx1k?%!F!46_y44+ c`gL0Fy;6ARqNSvIrGIMYmM=A6G({Nw1{)EhBme*a
--- a/src/testdir/test_crash.vim +++ b/src/testdir/test_crash.vim @@ -196,6 +196,12 @@ func Test_crash1_3() call term_sendkeys(buf, args) call TermWait(buf, 50) + let file = 'crash/dialog_changed_uaf' + let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'\<cr>" + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args) + call TermWait(buf, 150) + " clean up exe buf .. "bw!" bw!