Mercurial > vim
view READMEdir/README_vms.txt @ 33865:8cdb69ea3711 v9.0.2143
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Commit: https://github.com/vim/vim/commit/abfa13ebe92d81aaf66669c428d767847b577453
Author: Christian Brabandt <cb@256bit.org>
Date: Thu Nov 30 11:32:18 2023 +0100
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Problem: [security]: buffer-overflow in ex_substitute
Solution: clear memory after allocating
When allocating the new_start pointer in ex_substitute() the memory
pointer points to some garbage that the following for loop in
ex_cmds.c:4743 confuses and causes it to accessing the new_start pointer
beyond it's size, leading to a buffer-overlow.
So fix this by using alloc_clear() instead of alloc(), which will
clear the memory by NUL and therefore cause the loop to terminate
correctly.
Reported by @henices, thanks!
closes: #13596
Signed-off-by: Christian Brabandt <cb@256bit.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Sun, 10 Dec 2023 15:16:05 +0100 |
parents | f8116058ca76 |
children | 4635e43f2c6f |
line wrap: on
line source
README_vms.txt for version 9.0 of Vim: Vi IMproved. This file explains the installation of Vim on VMS systems. See "README.txt" in the runtime archive for information about Vim. Most information can be found in the on-line documentation. Use ":help vms" inside Vim. Or get the runtime files and read runtime/doc/os_vms.txt to find out how to install and configure Vim with runtime files etc. To compile Vim yourself you need three archives: vim-X.X-rt.tar.gz runtime files vim-X.X-src.tar.gz source files vim-X.X-extra.tar.gz extra source files Compilation is recommended, in order to make sure that the correct libraries are used for your specific system. Read about compiling in src/INSTALLvms.txt. To use the binary version, you need one of these archives: vim-XX-exe-ia64-gui.zip IA64 GUI/Motif executables vim-XX-exe-ia64-gtk.zip IA64 GUI/GTK executables vim-XX-exe-ia64-term.zip IA64 console executables vim-XX-exe-axp-gui.zip Alpha GUI/Motif executables vim-XX-exe-axp-gtk.zip Alpha GUI/GTK executables vim-XX-exe-axp-term.zip Alpha console executables vim-XX-exe-vax-gui.zip VAX GUI executables vim-XX-exe-vax-term.zip VAX console executables and of course vim-XX-runtime.zip runtime files The binary archives contain: vim.exe, ctags.exe, xxd.exe files, but there are also prepared "deploy ready" archives: vim-XX-ia64.zip GUI and console executables with runtime and help files for IA64 systems vim-XX-axp.zip GUI and console executables with runtime and help files for Alpha systems vim-XX-vax.zip GUI and console executables with runtime and help files for VAX systems GTK builds need LIBGTK library installed. These executables and up to date patches for OpenVMS system are downloadable from http://www.polarhome.com/vim/ or ftp://ftp.polarhome.com/pub/vim/