Mercurial > vim
view runtime/delmenu.vim @ 33879:d418c82f02a4 v9.0.2149
patch 9.0.2149: [security]: use-after-free in exec_instructions()
Commit: https://github.com/vim/vim/commit/5dd41d4b6370b7b7d09d691f9252b3899c66102a
Author: Christian Brabandt <cb@256bit.org>
Date: Mon Dec 4 22:52:23 2023 +0100
patch 9.0.2149: [security]: use-after-free in exec_instructions()
Problem: [security]: use-after-free in exec_instructions()
Solution: get tv pointer again
[security]: use-after-free in exec_instructions()
exec_instructions may access freed memory, if the GA_GROWS_FAILS()
re-allocates memory. When this happens, the typval tv may still point to
now already freed memory. So let's get that pointer again and compare it
with tv. If those two pointers differ, tv is now invalid and we have to
refresh the tv pointer.
closes: #13621
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 10 Dec 2023 15:16:17 +0100 |
| parents | 4027cefc2aab |
| children |
line wrap: on
line source
" This Vim script deletes all the menus, so that they can be redefined. " Warning: This also deletes all menus defined by the user! " " Maintainer: The Vim Project <https://github.com/vim/vim> " Last Change: 2023 Aug 10 " Former Maintainer: Bram Moolenaar <Bram@vim.org> aunmenu * tlunmenu * if exists('#SetupLazyloadMenus') au! SetupLazyloadMenus augroup! SetupLazyloadMenus endif if exists('#buffer_list') au! buffer_list augroup! buffer_list endif if exists('#LoadBufferMenu') au! LoadBufferMenu augroup! LoadBufferMenu endif if exists('#spellmenu') au! spellmenu augroup! spellmenu endif if exists('#SpellPopupMenu') au! SpellPopupMenu augroup! SpellPopupMenu endif unlet! g:did_install_default_menus unlet! g:did_install_syntax_menu if exists('g:did_menu_trans') menutrans clear unlet g:did_menu_trans endif unlet! g:find_help_dialog unlet! g:menutrans_fileformat_choices unlet! g:menutrans_fileformat_dialog unlet! g:menutrans_help_dialog unlet! g:menutrans_no_file unlet! g:menutrans_path_dialog unlet! g:menutrans_set_lang_to unlet! g:menutrans_spell_add_ARG_to_word_list unlet! g:menutrans_spell_change_ARG_to unlet! g:menutrans_spell_ignore_ARG unlet! g:menutrans_tags_dialog unlet! g:menutrans_textwidth_dialog " vim: set sw=2 :