patch 9.0.1969: [security] buffer-overflow in trunc_string() Commit: https://github.com/vim/vim/commit/3bd7fa12e146c6051490d048a4acbfba974eeb04 Author: Christian Brabandt <cb@256bit.org> Date: Mon Oct 2 20:59:08 2023 +0200 patch 9.0.1969: [security] buffer-overflow in trunc_string() Problem: buffer-overflow in trunc_string() Solution: Add NULL at end of buffer Currently trunc_string() assumes that when the string is too long, buf[e-1] will always be writeable. But that assumption may not always be true. The condition currently looks like this else if (e + 3 < buflen) [...] else { // can't fit in the "...", just truncate it buf[e - 1] = NUL; } but this means, we may run into the last else clause with e still being larger than buflen. So a buffer overflow occurs. So instead of using `buf[e - 1]`, let's just always truncate at `buf[buflen - 1]` which should always be writable. Signed-off-by: Christian Brabandt <cb@256bit.org>

// if_ole.idl - IDL source for the Vim OLE Automation interface
//
// Processed by the IDL compiler (MIDL) to generate the type library
// (Vim.tlb).
//
// Command line:
//   MIDL /proxy nul /iid iid_ole.c /h if_ole.h /tlb vim.tlb if_ole.idl

[
	object,
	uuid(0F0BFAE2-4C90-11d1-82D7-0004AC368519),  // IID_IVim
	helpstring("IVim"),
	pointer_default(unique),
	dual,
	oleautomation
]
interface IVim : IDispatch
{
	import "oaidl.idl";
	HRESULT SendKeys([in]BSTR keys);
	HRESULT Eval([in]BSTR expr, [out, retval]BSTR* result);
	HRESULT SetForeground(void);
	HRESULT GetHwnd([out, retval]UINT_PTR* result);
};

// Component and type library definitions
[
	uuid(0F0BFAE0-4C90-11d1-82D7-0004AC368519),		// LIBID_Vim
	helpstring("Vim OLE Interface 1.1 Type Library"),
	version(1.1)
]
library Vim
{
	importlib("stdole32.tlb");

	// Component
	[
		uuid(0F0BFAE1-4C90-11d1-82D7-0004AC368519),  // CLSID_Vim
		helpstring("Vim OLE Interface")
	]
	coclass Vim
	{
		[default] interface IVim;
	};
};