Mercurial > vim
view .github/labeler.yml @ 33829:f0132690cdf9 v9.0.2129
patch 9.0.2129: [security]: use-after-free in call_dfunc()
Commit: https://github.com/vim/vim/commit/a555069b7d790abedc60edc505bd35bda257949d
Author: mityu <mityu.mail@gmail.com>
Date: Sat Nov 25 15:41:20 2023 +0100
patch 9.0.2129: [security]: use-after-free in call_dfunc()
Problem: [security]: use-after-free in call_dfunc()
Solution: Refresh dfunc pointer
closes: #13571
This Commit fixes a SEGV caused by a use-after-free bug in call_dfunc().
When calling check_ufunc_arg_types() from the call_dfunc() it may cause
def functions to be re-compiled and if there are too many def functions,
the def_functions array will be re-allocated. Which means, that the
dfunc pointer in call_dfunc() now starts pointing to freed memory.
So we need to reset the dfunc pointer after calling
check_ufunc_arg_types().
Let's also add a test, to ensure we do not regress.
Signed-off-by: mityu <mityu.mail@gmail.com>
Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sat, 25 Nov 2023 16:00:03 +0100 |
| parents | d26117375a68 |
| children | e5e809eca554 |
line wrap: on
line source
# list of labels and minimatch globs to match to apply the label. CI: - any: ['.cirrus.yml'] - any: ['.github/dependabot.yml'] - any: ['.github/labeler.yml'] - any: ['.github/workflows/*'] - any: ['.appveyor.yml'] - any: ['.codecov.yml'] documentation: - all: ['*/doc/*'] translation: - any: ['src/po/*.po'] if_lua: - any: ['src/if_lua.c'] - any: ['src/proto/if_lua.pro'] - any: ['runtime/doc/if_lua.txt'] if_mzscheme: - any: ['src/if_mzsch.c'] - any: ['src/if_mzsch.h'] - any: ['src/proto/if_mzsch.pro'] - any: ['runtime/doc/if_mzsch.txt'] if_perl: - any: ['src/if_perl.xs'] - any: ['src/if_perlsfio.c'] - any: ['src/proto/if_perl.pro'] - any: ['src/proto/if_perlsfio.pro'] - any: ['runtime/doc/if_perl.txt'] if_python: - any: ['src/if_py_both.h'] - any: ['runtime/doc/if_pyth.txt'] - any: ['src/if_python.c'] - any: ['src/if_python3.c'] - any: ['src/proto/if_python.pro'] - any: ['src/proto/if_python3.pro'] if_ruby: - any: ['src/if_ruby.c'] - any: ['src/proto/if_ruby.pro'] - any: ['runtime/doc/if_ruby.txt'] if_tcl: - any: ['src/if_tcl.c'] - any: ['src/proto/if_tcl.pro'] - any: ['runtime/doc/if_tcl.txt'] installer: - any: ['nsis/**'] - any: ['src/dosinst.*'] - any: ['src/uninstall.c'] platform-mac: - any: ['src/INSTALLmac.txt'] - any: ['src/os_mac*'] - any: ['src/proto/os_mac*'] platform-windows: - any: ['nsis/**'] - any: ['src/*.bat'] - any: ['src/*.bmp'] - any: ['src/*.ico'] - any: ['src/GvimExt/*'] - any: ['src/INSTALLpc.txt'] - any: ['src/Make_cyg*.mak'] - any: ['src/Make_ming.mak'] - any: ['src/Make_mvc.mak'] - any: ['src/dosinst.*'] - any: ['src/gui_dwrite.*'] - any: ['src/gui_w32*'] - any: ['src/if_ole.*'] - any: ['src/iid_ole.c'] - any: ['src/os_mswin*'] - any: ['src/os_w32*'] - any: ['src/os_win32.*'] - any: ['src/proto/gui_w32.pro'] - any: ['src/proto/os_mswin.pro'] - any: ['src/proto/os_win32.pro'] - any: ['src/proto/winclip.pro'] - any: ['src/uninstall.c'] - any: ['src/vim.manifest'] - any: ['src/vim.rc'] - any: ['src/vimrun.c'] - any: ['src/winclip.c'] - any: ['src/xpm/**'] - any: ['src/xpm_w32.*'] runtime: - any: ['runtime/ftplugin'] - any: ['runtime/syntax'] - any: ['runtime/indent'] - any: ['runtime/pack/dist/opt/termdebug/plugin/termdebug.vim'] termdebug: runtime/pack/dist/opt/termdebug/plugin/termdebug.vim plugin-netrw: - any: ['runtime/plugin/netrwPlugin.vim'] - any: ['runtime/autoload/netrw*'] xxd: - any: ['src/xxd/*']