vim/backport-CVE-2022-3099.patch
2022-11-03 15:22:25 +08:00

59 lines
1.7 KiB
Diff
Raw Permalink Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

From 35d21c6830fc2d68aca838424a0e786821c5891c Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Fri, 2 Sep 2022 16:47:16 +0100
Subject: [PATCH] patch 9.0.0360: crash when invalid line number on :for is
ignored
Problem: Crash when invalid line number on :for is ignored.
Solution: Do not check breakpoint for non-existing line.
---
src/ex_docmd.c | 2 +-
src/testdir/test_eval_stuff.vim | 13 +++++++++++++
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index ae1f195..0b6b217 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -1068,7 +1068,7 @@ do_cmdline(
// Check for the next breakpoint at or after the ":while"
// or ":for".
- if (breakpoint != NULL)
+ if (breakpoint != NULL && lines_ga.ga_len > current_line)
{
*breakpoint = dbg_find_breakpoint(
getline_equal(fgetline, cookie, getsourceline),
diff --git a/src/testdir/test_eval_stuff.vim b/src/testdir/test_eval_stuff.vim
index 313d791..934286b 100644
--- a/src/testdir/test_eval_stuff.vim
+++ b/src/testdir/test_eval_stuff.vim
@@ -1,6 +1,7 @@
" Tests for various eval things.
source view_util.vim
+source shared.vim
function s:foo() abort
try
@@ -634,4 +635,16 @@ func Test_eval_string_in_special_key()
silent! echo 0{1-$"\<S--{>n|nö%
endfunc
+func Test_for_invalid_line_count()
+ let lines =<< trim END
+ 111111111111111111111111 for line in ['one']
+ endfor
+ END
+ call writefile(lines, 'XinvalidFor')
+ " only test that this doesn't crash
+ call RunVim([], [], '-u NONE -e -s -S XinvalidFor -c qa')
+
+ call delete('XinvalidFor')
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
--
1.8.3.1