Mercurial > vim

comparison src/testdir/test_xxd.vim @ 35150:42f061099b39 v9.1.0404

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 9.1.0404: [security] xxd: buffer-overflow with specific flags Commit: https://github.com/vim/vim/commit/67797191e039196128c69ba1538ccaf2a4711323 Author: Lennard Hofmann <lennard.hofmann@web.de> Date: Fri May 10 14:17:26 2024 +0200 patch 9.1.0404: [security] xxd: buffer-overflow with specific flags Problem: [security] xxd: buffer-overflow with specific flags Solution: Correctly calculate the required buffer space (Lennard Hofmann) xxd writes each output line into a global buffer before printing. The maximum size of that buffer was not calculated correctly. This command was crashing in AddressSanitizer: $ xxd -Ralways -g1 -c256 -d -o 9223372036854775808 /etc/passwd This prints a line of 6680 bytes but the buffer only had room for 6549 bytes. If the output from "-b" was colored, the line could be even longer. closes: #14738 Co-authored-by: K.Takata <kentkt@csc.jp> Signed-off-by: Lennard Hofmann <lennard.hofmann@web.de> Signed-off-by: Christian Brabandt <cb@256bit.org>
author Christian Brabandt <cb@256bit.org>
date Fri, 10 May 2024 14:45:03 +0200
parents 5aee5855ccfe
children b2ea090aea59
comparison
equal deleted inserted replaced
35149:7720516ffcea 35150:42f061099b39
407 exe 'r! printf "ignored" | ' . s:xxd_cmd . ' ' . cols . ' ' . fmt 407 exe 'r! printf "ignored" | ' . s:xxd_cmd . ' ' . cols . ' ' . fmt
408 call assert_match("invalid number of columns", join(getline(1, '$'))) 408 call assert_match("invalid number of columns", join(getline(1, '$')))
409 bwipe! 409 bwipe!
410 endfor 410 endfor
411 endfor 411 endfor
412 endfunc
413
414
415 " Try to trigger a buffer overflow (#14738)
416 func Test_xxd_buffer_overflow()
417 CheckUnix
418 new
419 let input = repeat('A', 256)
420 call writefile(['-9223372036854775808: ' . repeat("\e[1;32m41\e[0m ", 256) . ' ' . repeat("\e[1;32mA\e[0m", 256)], 'Xxdexpected', 'D')
421 exe 'r! printf ' . input . '| ' . s:xxd_cmd . ' -Ralways -g1 -c256 -d -o 9223372036854775808 > Xxdout'
422 call assert_equalfile('Xxdexpected', 'Xxdout')
423 call delete('Xxdout')
424 bwipe!
412 endfunc 425 endfunc
413 426
414 " -c0 selects the format specific default column value, as if no -c was given 427 " -c0 selects the format specific default column value, as if no -c was given
415 " except for -ps, where it disables extra newlines 428 " except for -ps, where it disables extra newlines
416 func Test_xxd_c0_is_def_cols() 429 func Test_xxd_c0_is_def_cols()