Mercurial > vim
view runtime/syntax/services.vim @ 33865:8cdb69ea3711 v9.0.2143
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Commit: https://github.com/vim/vim/commit/abfa13ebe92d81aaf66669c428d767847b577453
Author: Christian Brabandt <cb@256bit.org>
Date: Thu Nov 30 11:32:18 2023 +0100
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Problem: [security]: buffer-overflow in ex_substitute
Solution: clear memory after allocating
When allocating the new_start pointer in ex_substitute() the memory
pointer points to some garbage that the following for loop in
ex_cmds.c:4743 confuses and causes it to accessing the new_start pointer
beyond it's size, leading to a buffer-overlow.
So fix this by using alloc_clear() instead of alloc(), which will
clear the memory by NUL and therefore cause the loop to terminate
correctly.
Reported by @henices, thanks!
closes: #13596
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 10 Dec 2023 15:16:05 +0100 |
| parents | 1218c5353e2b |
| children |
line wrap: on
line source
" Vim syntax file " Language: services(5) - Internet network services list " Previous Maintainer: Nikolai Weibull <now@bitwi.se> " Latest Revision: 2006-04-19 if exists("b:current_syntax") finish endif let s:cpo_save = &cpo set cpo&vim syn match servicesBegin display '^' \ nextgroup=servicesName,servicesComment syn match servicesName contained display '[[:graph:]]\+' \ nextgroup=servicesPort skipwhite syn match servicesPort contained display '\d\+' \ nextgroup=servicesPPDiv,servicesPPDivDepr \ skipwhite syn match servicesPPDiv contained display '/' \ nextgroup=servicesProtocol skipwhite syn match servicesPPDivDepr contained display ',' \ nextgroup=servicesProtocol skipwhite syn match servicesProtocol contained display '\S\+' \ nextgroup=servicesAliases,servicesComment \ skipwhite syn match servicesAliases contained display '\S\+' \ nextgroup=servicesAliases,servicesComment \ skipwhite syn keyword servicesTodo contained TODO FIXME XXX NOTE syn region servicesComment display oneline start='#' end='$' \ contains=servicesTodo,@Spell hi def link servicesTodo Todo hi def link servicesComment Comment hi def link servicesName Identifier hi def link servicesPort Number hi def link servicesPPDiv Delimiter hi def link servicesPPDivDepr Error hi def link servicesProtocol Type hi def link servicesAliases Macro let b:current_syntax = "services" let &cpo = s:cpo_save unlet s:cpo_save