annotate pixmaps/tb_cut.xpm @ 33915:a49ae967e9ed
v9.0.2158
patch 9.0.2158: [security]: use-after-free in check_argument_type
Commit: https://github.com/vim/vim/commit/0f28791b215bd4c22ed580839409c2f7d39d8140
Author: Christian Brabandt <cb@256bit.org>
Date: Mon Dec 11 17:53:25 2023 +0100
patch 9.0.2158: [security]: use-after-free in check_argument_type
Problem: [security]: use-after-free in check_argument_type
Solution: Reset function type pointer when freeing the function type
list
function pointer fp->uf_func_type may point to the same memory, that was
allocated for fp->uf_type_list. However, when cleaning up a function
definition (e.g. because it was invalid), fp->uf_type_list will be
freed, but fp->uf_func_type may still point to the same (now) invalid
memory address.
So when freeing the fp->uf_type_list, check if fp->func_type points to
any of those types and if it does, reset the fp->uf_func_type pointer to
the t_func_any (default) type pointer
closes: #13652
Signed-off-by: Christian Brabandt <cb@256bit.org>
author |
Christian Brabandt <cb@256bit.org> |
date |
Mon, 11 Dec 2023 18:00:03 +0100 |
parents |
3fc0f57ecb91 |
children |
|
rev |
line source |
7
|
1 /* XPM */
|
|
2 static char * tb_cut_xpm[] = {
|
|
3 /* width height ncolors cpp [x_hot y_hot] */
|
|
4 "18 18 3 1 0 0",
|
|
5 /* colors */
|
|
6 " s none m none c none",
|
|
7 ". s iconColor1 m black c #000000",
|
|
8 "X s bottomShadowColor m black c #5D6069",
|
|
9 /* pixels */
|
|
10 " ",
|
|
11 " . .X ",
|
|
12 " .X .X ",
|
|
13 " . .X ",
|
|
14 " .X .X ",
|
|
15 " . .X ",
|
|
16 " .X.X ",
|
|
17 " .X ",
|
|
18 " ...X ",
|
|
19 " X.X .X ",
|
|
20 " ...X ... ",
|
|
21 " .XX.X .X . ",
|
|
22 " . .X .X .X ",
|
|
23 " . .X .X .X ",
|
|
24 " ..XX ..X ",
|
|
25 " XX XX ",
|
|
26 " ",
|
|
27 " "};
|