Mercurial > vim
view src/testdir/test_unlet.vim @ 33863:3b8089d550eb v9.0.2141
patch 9.0.2141: [security]: buffer-overflow in suggest_trie_walk
Commit: https://github.com/vim/vim/commit/0fb375aae608d7306b4baf9c1f906961f32e2abf
Author: Christian Brabandt <cb@256bit.org>
Date: Wed Nov 29 10:23:39 2023 +0100
patch 9.0.2141: [security]: buffer-overflow in suggest_trie_walk
Problem: [security]: buffer-overflow in suggest_trie_walk
Solution: Check n before using it as index into byts array
Basically, n as an index into the byts array, can point to beyond the byts
array. So let's double check, that n is within the expected range after
incrementing it from sp->ts_curi and bail out if it would be invalid.
Reported by @henices, thanks!
Signed-off-by: Christian Brabandt <cb@256bit.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Sun, 10 Dec 2023 15:16:03 +0100 |
parents | 0b35a7ffceb2 |
children |
line wrap: on
line source
" Tests for :unlet func Test_read_only() " these caused a crash call assert_fails('unlet count', 'E795:') call assert_fails('unlet errmsg', 'E795:') endfunc func Test_existing() let does_exist = 1 call assert_true(exists('does_exist')) unlet does_exist call assert_false(exists('does_exist')) endfunc func Test_not_existing() unlet! does_not_exist call assert_fails('unlet does_not_exist', 'E108:') endfunc func Test_unlet_fails() call assert_fails('unlet v:["count"]', 'E46:') call assert_fails('unlet $', 'E475:') let v = {} call assert_fails('unlet v[:]', 'E719:') let l = [] call assert_fails("unlet l['k'", 'E111:') let d = {'k' : 1} call assert_fails("unlet d.k2", 'E716:') call assert_fails("unlet {a};", 'E488:') endfunc func Test_unlet_env() let envcmd = has('win32') ? 'set' : 'env' let $FOOBAR = 'test' let found = 0 for kv in split(system(envcmd), "\r*\n") if kv == 'FOOBAR=test' let found = 1 endif endfor call assert_equal(1, found) unlet $FOOBAR let found = 0 for kv in split(system(envcmd), "\r*\n") if kv == 'FOOBAR=test' let found = 1 endif endfor call assert_equal(0, found) unlet $MUST_NOT_BE_AN_ERROR endfunc func Test_unlet_complete() let g:FOOBAR = 1 call feedkeys(":unlet g:FOO\t\n", 'tx') call assert_true(!exists('g:FOOBAR')) let $FOOBAR = 1 call feedkeys(":unlet $FOO\t\n", 'tx') call assert_true(!exists('$FOOBAR') || empty($FOOBAR)) endfunc " vim: shiftwidth=2 sts=2 expandtab