Mercurial > vim
view runtime/syntax/viminfo.vim @ 33865:8cdb69ea3711 v9.0.2143
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Commit: https://github.com/vim/vim/commit/abfa13ebe92d81aaf66669c428d767847b577453
Author: Christian Brabandt <cb@256bit.org>
Date: Thu Nov 30 11:32:18 2023 +0100
patch 9.0.2143: [security]: buffer-overflow in ex_substitute
Problem: [security]: buffer-overflow in ex_substitute
Solution: clear memory after allocating
When allocating the new_start pointer in ex_substitute() the memory
pointer points to some garbage that the following for loop in
ex_cmds.c:4743 confuses and causes it to accessing the new_start pointer
beyond it's size, leading to a buffer-overlow.
So fix this by using alloc_clear() instead of alloc(), which will
clear the memory by NUL and therefore cause the loop to terminate
correctly.
Reported by @henices, thanks!
closes: #13596
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 10 Dec 2023 15:16:05 +0100 |
| parents | 4027cefc2aab |
| children |
line wrap: on
line source
" Vim syntax file " Language: Vim .viminfo file " Maintainer: The Vim Project <https://github.com/vim/vim> " Last Change: 2023 Aug 10 " Former Maintainer: Bram Moolenaar <Bram@vim.org> " Quit when a (custom) syntax file was already loaded if exists("b:current_syntax") finish endif let s:cpo_save = &cpo set cpo&vim " The lines that are NOT recognized syn match viminfoError "^[^\t].*" " The one-character one-liners that are recognized syn match viminfoStatement "^[/&$@:?=%!<]" " The two-character one-liners that are recognized syn match viminfoStatement "^[-'>"]." syn match viminfoStatement +^"".+ syn match viminfoStatement "^\~[/&]" syn match viminfoStatement "^\~[hH]" syn match viminfoStatement "^\~[mM][sS][lL][eE]\d\+\~\=[/&]" syn match viminfoOption "^\*.*=" contains=viminfoOptionName syn match viminfoOptionName "\*\a*"ms=s+1 contained " Comments syn match viminfoComment "^#.*" " New style lines. TODO: highlight numbers and strings. syn match viminfoNew "^|.*" " Define the default highlighting. " Only used when an item doesn't have highlighting yet hi def link viminfoComment Comment hi def link viminfoError Error hi def link viminfoStatement Statement hi def link viminfoNew String let b:current_syntax = "viminfo" let &cpo = s:cpo_save unlet s:cpo_save " vim: ts=8 sw=2