vim/backport-CVE-2022-3278.patch
2022-11-03 15:22:25 +08:00

57 lines
1.5 KiB
Diff

From 69082916c8b5d321545d60b9f5facad0a2dd5a4e Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Thu, 22 Sep 2022 21:35:19 +0100
Subject: [PATCH] patch 9.0.0552: crash when using NUL in buffer that uses
:source
Problem: Crash when using NUL in buffer that uses :source.
Solution: Don't get a next line when skipping over NL.
---
src/eval.c | 2 +-
src/testdir/test_source.vim | 17 +++++++++++++++++
2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/src/eval.c b/src/eval.c
index 60daca5..8df374a 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -2278,7 +2278,7 @@ eval_next_non_blank(char_u *arg, evalarg_T *evalarg, int *getnext)
if (next != NULL)
{
- *getnext = TRUE;
+ *getnext = *p != NL;
return skipwhite(next);
}
}
diff --git a/src/testdir/test_source.vim b/src/testdir/test_source.vim
index 4736e93..d6aed57 100644
--- a/src/testdir/test_source.vim
+++ b/src/testdir/test_source.vim
@@ -665,5 +665,22 @@ func Test_source_buffer_long_line()
call delete('Xtest.vim')
endfunc
+func Test_source_buffer_with_NUL_char()
+ " This was trying to use a line below the buffer.
+ let lines =<< trim END
+ if !exists('g:loaded')
+ let g:loaded = 1
+ source
+ endif
+ END
+ " Can't have a NL in heredoc
+ let lines += ["silent! vim9 echo [0 \<NL> ? 'a' : 'b']"]
+ call writefile(lines, 'XsourceNul', '')
+ edit XsourceNul
+ source
+
+ bwipe!
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
--
2.27.0