Mercurial > vim
view runtime/syntax/scdoc.vim @ 33865:8cdb69ea3711 v9.0.2143
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Commit: https://github.com/vim/vim/commit/abfa13ebe92d81aaf66669c428d767847b577453
Author: Christian Brabandt <cb@256bit.org>
Date: Thu Nov 30 11:32:18 2023 +0100
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Problem: [security]: buffer-overflow in ex_substitute
Solution: clear memory after allocating
When allocating the new_start pointer in ex_substitute() the memory
pointer points to some garbage that the following for loop in
ex_cmds.c:4743 confuses and causes it to accessing the new_start pointer
beyond it's size, leading to a buffer-overlow.
So fix this by using alloc_clear() instead of alloc(), which will
clear the memory by NUL and therefore cause the loop to terminate
correctly.
Reported by @henices, thanks!
closes: #13596
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 10 Dec 2023 15:16:05 +0100 |
| parents | cd68a630f0d0 |
| children |
line wrap: on
line source
" Syntax file for scdoc files " Maintainer: Gregory Anders <contact@gpanders.com> " Last Updated: 2022-05-09 " Upstream: https://github.com/gpanders/vim-scdoc if exists('b:current_syntax') finish endif let b:current_syntax = 'scdoc' syntax match scdocFirstLineError "\%^.*$" syntax match scdocFirstLineValid "\%^\S\+(\d[0-9A-Za-z]*)\%(\s\+\"[^"]*\"\%(\s\+\"[^"]*\"\)\=\)\=$" syntax region scdocCommentError start="^;\S" end="$" keepend syntax region scdocComment start="^; " end="$" keepend syntax region scdocHeaderError start="^#\{3,}" end="$" keepend syntax region scdocHeader start="^#\{1,2}" end="$" keepend syntax match scdocIndentError "^[ ]\+" syntax match scdocLineBreak "++$" syntax region scdocOrderedListItem matchgroup=scdocOrderedListMarker start="^\z(\s*\)\." skip="^\z1 .*$" end="^" contains=scdocBold,scdocUnderline syntax region scdocListItem matchgroup=scdocListMarker start="^\z(\s*\)-" skip="^\z1 .*$" end="^" contains=scdocBold,scdocUnderline " Tables cannot start with a column syntax match scdocTableError "^:" syntax region scdocTable matchgroup=scdocTableEntry start="^[\[|\]][\[\-\]<=>]" end="^$" contains=scdocTableEntry,scdocTableError,scdocTableContinuation,scdocBold,scdocUnderline,scdocPre syntax match scdocTableError "^.*$" contained syntax match scdocTableContinuation "^ \+\S\+" contained syntax match scdocTableEntry "^[|:][\[\-\]<=> ]" contained syntax match scdocTableError "^[|:][\[\-\]<=> ]\S.*$" contained syntax region scdocBold concealends matchgroup=scdocBoldDelimiter start="\\\@<!\*" end="\\\@<!\*" syntax region scdocUnderline concealends matchgroup=scdocUnderlineDelimiter start="\<\\\@<!_" end="\\\@<!_\>" syntax region scdocPre matchgroup=scdocPreDelimiter start="^\t*```" end="^\t*```" syntax sync minlines=50 hi default link scdocFirstLineValid Comment hi default link scdocComment Comment hi default link scdocHeader Title hi default link scdocOrderedListMarker Statement hi default link scdocListMarker scdocOrderedListMarker hi default link scdocLineBreak Special hi default link scdocTableSpecifier Statement hi default link scdocTableEntry Statement hi default link scdocFirstLineError Error hi default link scdocCommentError Error hi default link scdocHeaderError Error hi default link scdocIndentError Error hi default link scdocTableError Error hi default link scdocTableError Error hi default link scdocPreDelimiter Delimiter hi default scdocBold term=bold cterm=bold gui=bold hi default scdocUnderline term=underline cterm=underline gui=underline hi default link scdocBoldDelimiter scdocBold hi default link scdocUnderlineDelimiter scdocUnderline