vim/backport-CVE-2023-0288.patch
2023-01-29 11:42:47 +08:00

45 lines
1.4 KiB
Diff
Raw Permalink Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

From 232bdaaca98c34a99ffadf27bf6ee08be6cc8f6a Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Fri, 13 Jan 2023 14:17:58 +0000
Subject: [PATCH] patch 9.0.1189: invalid memory access with folding and using
"L"
Problem: Invalid memory access with folding and using "L".
Solution: Prevent the cursor from moving to line zero.
---
src/normal.c | 3 ++-
src/testdir/test_fold.vim | 8 ++++++++
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/src/normal.c b/src/normal.c
index c319be599ad7..3d9f74dec558 100644
--- a/src/normal.c
+++ b/src/normal.c
@@ -3757,7 +3757,8 @@ nv_scroll(cmdarg_T *cap)
{
(void)hasFolding(curwin->w_cursor.lnum,
&curwin->w_cursor.lnum, NULL);
- --curwin->w_cursor.lnum;
+ if (curwin->w_cursor.lnum > curwin->w_topline)
+ --curwin->w_cursor.lnum;
}
}
else
diff --git a/src/testdir/test_fold.vim b/src/testdir/test_fold.vim
index adf9e5207838..f915a661336b 100644
--- a/src/testdir/test_fold.vim
+++ b/src/testdir/test_fold.vim
@@ -1547,4 +1547,12 @@ func Test_sort_closed_fold()
bw!
endfunc
+func Test_indent_with_L_command()
+ " The "L" command moved the cursor to line zero, causing the text saved for
+ " undo to use line number -1, which caused trouble for undo later.
+ new
+ sil! norm 8R
V{zf8=Lu
+ bwipe!
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab