IntenseFinance/neovim
3
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-02-25 18:55:25 -06:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.0.1858: [security] heap use after free in ins_compl_get_exp()

Browse Source 
Problem:  heap use after free in ins_compl_get_exp()
Solution: validate buffer before accessing it

ee9166eb3b

Co-authored-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
zeertzjq 2023-11-17 09:12:01 +08:00
parent a589156b4d
commit 8dc72789cf
3 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/nvim/insexpand.c
View File

@ -3435,7 +3435,7 @@ static int ins_compl_get_exp(pos_T *ini)
compl_started = true; compl_started = true;
} else { } else {
// Mark a buffer scanned when it has been scanned completely // Mark a buffer scanned when it has been scanned completely
if (type == 0 || type == CTRL_X_PATH_PATTERNS) { if (buf_valid(st.ins_buf) && (type == 0 || type == CTRL_X_PATH_PATTERNS)) {
assert(st.ins_buf); assert(st.ins_buf);
st.ins_buf->b_scanned = true; st.ins_buf->b_scanned = true;
} }

6
test/old/testdir/crash/poc_tagfunc.vim Normal file
View File

@ -0,0 +1,6 @@
fu Tagfunc(t,f,o)
bw
endf
set tagfunc=Tagfunc
n0
sil0norm0i

10
test/old/testdir/test_crash.vim
View File

@ -39,12 +39,17 @@ func Test_crash1()
\ ' && echo "crash 4: [OK]" >> X_crash1_result.txt' .. "\<cr>") \ ' && echo "crash 4: [OK]" >> X_crash1_result.txt' .. "\<cr>")
" clean up " clean up
call delete('Xerr') call delete('Xerr')
" This test takes a bit longer " This test takes a bit longer
call TermWait(buf, 200) call TermWait(buf, 200)
let file = 'crash/poc_tagfunc.vim'
let args = printf(cmn_args, vim, file)
call term_sendkeys(buf, args ..
\ ' || echo "crash 5: [OK]" >> X_crash1_result.txt' .. "\<cr>")
call TermWait(buf, 100)
" clean up " clean up
call delete('Xerr')
exe buf .. "bw!" exe buf .. "bw!"
sp X_crash1_result.txt sp X_crash1_result.txt
@ -54,6 +59,7 @@ func Test_crash1()
\ 'crash 2: [OK]', \ 'crash 2: [OK]',
\ 'crash 3: [OK]', \ 'crash 3: [OK]',
\ 'crash 4: [OK]', \ 'crash 4: [OK]',
\ 'crash 5: [OK]',
\ ] \ ]
call assert_equal(expected, getline(1, '$')) call assert_equal(expected, getline(1, '$'))