Mercurial > vim
view runtime/syntax/squirrel.vim @ 33865:8cdb69ea3711 v9.0.2143
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Commit: https://github.com/vim/vim/commit/abfa13ebe92d81aaf66669c428d767847b577453
Author: Christian Brabandt <cb@256bit.org>
Date: Thu Nov 30 11:32:18 2023 +0100
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Problem: [security]: buffer-overflow in ex_substitute
Solution: clear memory after allocating
When allocating the new_start pointer in ex_substitute() the memory
pointer points to some garbage that the following for loop in
ex_cmds.c:4743 confuses and causes it to accessing the new_start pointer
beyond it's size, leading to a buffer-overlow.
So fix this by using alloc_clear() instead of alloc(), which will
clear the memory by NUL and therefore cause the loop to terminate
correctly.
Reported by @henices, thanks!
closes: #13596
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 10 Dec 2023 15:16:05 +0100 |
| parents | c725b8e17f1f |
| children | c62bca3b8d82 |
line wrap: on
line source
" Vim syntax file " Language: squirrel " Current Maintainer: Matt Dunford (zenmatic@gmail.com) " URL: https://github.com/zenmatic/vim-syntax-squirrel " Last Change: 2021 Nov 28 " http://squirrel-lang.org/ " quit when a syntax file was already loaded if exists("b:current_syntax") finish endif " inform C syntax that the file was included from cpp.vim let b:filetype_in_cpp_family = 1 " Read the C syntax to start with runtime! syntax/c.vim unlet b:current_syntax " squirrel extensions syn keyword squirrelStatement delete this in yield resume base clone syn keyword squirrelAccess local syn keyword cConstant null syn keyword squirrelModifier static syn keyword squirrelType bool instanceof typeof syn keyword squirrelExceptions throw try catch syn keyword squirrelStructure class function extends constructor syn keyword squirrelBoolean true false syn keyword squirrelRepeat foreach syn region squirrelMultiString start='@"' end='"$' end='";$'me=e-1 syn match squirrelShComment "^\s*#.*$" " Default highlighting hi def link squirrelAccess squirrelStatement hi def link squirrelExceptions Exception hi def link squirrelStatement Statement hi def link squirrelModifier Type hi def link squirrelType Type hi def link squirrelStructure Structure hi def link squirrelBoolean Boolean hi def link squirrelMultiString String hi def link squirrelRepeat cRepeat hi def link squirrelShComment Comment let b:current_syntax = "squirrel" " vim: ts=8