Mercurial > vim
view src/iid_ole.c @ 33829:f0132690cdf9 v9.0.2129
patch 9.0.2129: [security]: use-after-free in call_dfunc()
Commit: https://github.com/vim/vim/commit/a555069b7d790abedc60edc505bd35bda257949d
Author: mityu <mityu.mail@gmail.com>
Date: Sat Nov 25 15:41:20 2023 +0100
patch 9.0.2129: [security]: use-after-free in call_dfunc()
Problem: [security]: use-after-free in call_dfunc()
Solution: Refresh dfunc pointer
closes: #13571
This Commit fixes a SEGV caused by a use-after-free bug in call_dfunc().
When calling check_ufunc_arg_types() from the call_dfunc() it may cause
def functions to be re-compiled and if there are too many def functions,
the def_functions array will be re-allocated. Which means, that the
dfunc pointer in call_dfunc() now starts pointing to freed memory.
So we need to reset the dfunc pointer after calling
check_ufunc_arg_types().
Let's also add a test, to ensure we do not regress.
Signed-off-by: mityu <mityu.mail@gmail.com>
Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Sat, 25 Nov 2023 16:00:03 +0100 |
parents | 82c732e8d23d |
children |
line wrap: on
line source
// this file contains the actual definitions of // the IIDs and CLSIDs // link this file in with the server and any clients // File created by MIDL compiler version 3.00.44 // at Sat Jan 03 16:34:55 1998 // Compiler settings for if_ole.idl: // Os (OptLev=s), W1, Zp8, env=Win32, ms_ext, c_ext // error checks: none //@@MIDL_FILE_HEADING( ) #ifdef __cplusplus extern "C"{ #endif #ifdef __MINGW32__ # include <w32api.h> # if __W32API_MAJOR_VERSION == 3 && __W32API_MINOR_VERSION < 10 // This define is missing from older MingW versions of w32api, even though // IID is defined. # define __IID_DEFINED__ # endif #endif #ifndef __IID_DEFINED__ # define __IID_DEFINED__ typedef struct _IID { unsigned long x; unsigned short s1; unsigned short s2; unsigned char c[8]; } IID; #endif #ifndef CLSID_DEFINED # define CLSID_DEFINED typedef IID CLSID; #endif const IID IID_IVim = {0x0F0BFAE2,0x4C90,0x11d1,{0x82,0xD7,0x00,0x04,0xAC,0x36,0x85,0x19}}; const IID LIBID_Vim = {0x0F0BFAE0,0x4C90,0x11d1,{0x82,0xD7,0x00,0x04,0xAC,0x36,0x85,0x19}}; const CLSID CLSID_Vim = {0x0F0BFAE1,0x4C90,0x11d1,{0x82,0xD7,0x00,0x04,0xAC,0x36,0x85,0x19}}; #ifdef __cplusplus } #endif