patch 9.0.2035: [security] use-after-free with wildmenu Commit: https://github.com/vim/vim/commit/8f4fb007e4d472b09ff6bed9ffa485e0c3093699 Author: Yee Cheng Chin <ychin.git@gmail.com> Date: Tue Oct 17 10:06:56 2023 +0200 patch 9.0.2035: [security] use-after-free with wildmenu Problem: [security] use-after-free with wildmenu Solution: properly clean up the wildmenu when exiting Fix wildchar/wildmenu/pum memory corruption with special wildchar's Currently, using `wildchar=<Esc>` or `wildchar=<C-\>` can lead to a memory corruption if using wildmenu+pum, or wrong states if only using wildmenu. This is due to the code only using one single place inside the cmdline process loop to perform wild menu clean up (by checking `end_wildmenu`) but there are other odd situations where the loop could have exited and we need a post-loop clean up just to be sure. If the clean up was not done you would have a stale popup menu referring to invalid memory, or if not using popup menu, incorrect status line (if `laststatus=0`). For example, if you hit `<Esc>` two times when it's wildchar, there's a hard-coded behavior to exit command-line as a failsafe for user, and if you hit `<C-\><C-\><C-N>` it will also exit command-line, but the clean up code would not have hit because of specialized `<C-\>` handling. Fix Ctrl-E / Ctrl-Y to not cancel/accept wildmenu if they are also used for 'wildchar'/'wildcharm'. Currently they don't behave properly, and also have potentially memory unsafe behavior as the logic is currently not accounting for this situation and try to do both. (Previous patch that addressed this: #11677) Also, correctly document Escape key behavior (double-hit it to escape) in wildchar docs as it's previously undocumented. In addition, block known invalid chars to be set in `wildchar` option, such as Ctrl-C and `<CR>`. This is just to make it clear to the user they shouldn't be set, and is not required for this bug fix. closes: #13361 Signed-off-by: Christian Brabandt <cb@256bit.org> Co-authored-by: Yee Cheng Chin <ychin.git@gmail.com>

#!/bin/sh

# Start Vim on a copy of the tutor file.

# Usage: vimtutor [-g] [xx]
# Where optional argument -g starts vimtutor in gvim (GUI) instead of vim.
# and xx is a language code like "es" or "nl".
# When an argument is given, it tries loading that tutor.
# When this fails or no argument was given, it tries using 'v:lang'
# When that also fails, it uses the English version.

# Vim could be called "vim" or "vi".  Also check for "vimN", for people who
# have Vim installed with its version number.
# We anticipate up to a future Vim 8.1 version :-).
seq="vim vim81 vim80 vim8 vim74 vim73 vim72 vim71 vim70 vim7 vim6 vi"
if test "$1" = "-g"; then
    # Try to use the GUI version of Vim if possible, it will fall back
    # on Vim if Gvim is not installed.
    seq="gvim gvim81 gvim80 gvim8 gvim74 gvim73 gvim72 gvim71 gvim70 gvim7 gvim6 $seq"
    shift
fi

xx=$1
export xx

# We need a temp file for the copy.  First try using a standard command.
tmp="${TMPDIR-/tmp}"
TUTORCOPY=`mktemp $tmp/tutorXXXXXX || tempfile -p tutor || echo none`

# If the standard commands failed then create a directory to put the copy in.
# That is a secure way to make a temp file.
if test "$TUTORCOPY" = none; then
	tmpdir=$tmp/vimtutor$$
	OLD_UMASK=`umask`
	umask 077
	getout=no
	mkdir $tmpdir || getout=yes
	umask $OLD_UMASK
	if test $getout = yes; then
		echo "Could not create directory for tutor copy, exiting."
		exit 1
	fi
	TUTORCOPY=$tmpdir/tutorcopy
	touch $TUTORCOPY
	TODELETE=$tmpdir
else
	TODELETE=$TUTORCOPY
fi

export TUTORCOPY

# remove the copy of the tutor on exit
trap "rm -rf $TODELETE" 0 1 2 3 9 11 13 15

for i in $seq; do
    testvim=$(which $i 2>/dev/null)
    if test -f "$testvim"; then
        VIM=$i
        break
    fi
done

# When no Vim version was found fall back to "vim", you'll get an error message
# below.
if test -z "$VIM"; then
    VIM=vim
fi

# Use Vim to copy the tutor, it knows the value of $VIMRUNTIME
# The script tutor.vim tells Vim which file to copy
$VIM -f -u NONE -c 'so $VIMRUNTIME/tutor/tutor.vim'

# Start vim without any .vimrc, set 'nocompatible' and 'showcmd'
$VIM -f -u NONE -c "set nocp showcmd" "$TUTORCOPY"