view runtime/ftplugin.vim @ 33829:f0132690cdf9 v9.0.2129

patch 9.0.2129: [security]: use-after-free in call_dfunc() Commit: https://github.com/vim/vim/commit/a555069b7d790abedc60edc505bd35bda257949d Author: mityu <mityu.mail@gmail.com> Date: Sat Nov 25 15:41:20 2023 +0100 patch 9.0.2129: [security]: use-after-free in call_dfunc() Problem: [security]: use-after-free in call_dfunc() Solution: Refresh dfunc pointer closes: #13571 This Commit fixes a SEGV caused by a use-after-free bug in call_dfunc(). When calling check_ufunc_arg_types() from the call_dfunc() it may cause def functions to be re-compiled and if there are too many def functions, the def_functions array will be re-allocated. Which means, that the dfunc pointer in call_dfunc() now starts pointing to freed memory. So we need to reset the dfunc pointer after calling check_ufunc_arg_types(). Let's also add a test, to ensure we do not regress. Signed-off-by: mityu <mityu.mail@gmail.com> Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
author Christian Brabandt <cb@256bit.org>
date Sat, 25 Nov 2023 16:00:03 +0100
parents 4027cefc2aab
children
line wrap: on
line source

vim9script noclear

# Vim support file to switch on loading plugins for file types
#
# Maintainer:	The Vim Project <https://github.com/vim/vim>
# Last change:	2023 Aug 10
# Former Maintainer:	Bram Moolenaar <Bram@vim.org>

if exists("g:did_load_ftplugin")
  finish
endif
g:did_load_ftplugin = 1

augroup filetypeplugin
  au FileType * call LoadFTPlugin()
augroup END

if exists('*LoadFTPlugin')
  # No need to define the function again.
  finish
endif

def LoadFTPlugin()
  if exists("b:undo_ftplugin")
    # We assume b:undo_ftplugin is using legacy script syntax
    legacy exe b:undo_ftplugin
    unlet! b:undo_ftplugin b:did_ftplugin
  endif

  var s = expand("<amatch>")
  if s != ""
    if &cpo =~# "S" && exists("b:did_ftplugin")
      # In compatible mode options are reset to the global values, need to
      # set the local values also when a plugin was already used.
      unlet b:did_ftplugin
    endif

    # When there is a dot it is used to separate filetype names.  Thus for
    # "aaa.bbb" load "aaa" and then "bbb".
    for name in split(s, '\.')
      exe 'runtime! ftplugin/' .. name .. '.vim ftplugin/' .. name .. '_*.vim ftplugin/' .. name .. '/*.vim'
    endfor
  endif
enddef