vim/backport-CVE-2023-4734.patch
wangjiang 49a60b4e33 fix CVE-2023-4736 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735
(cherry picked from commit 1f97a3d5951002935a4abf4dbefb1b843d6b099f)
2023-09-11 22:41:53 +08:00

45 lines
1.2 KiB
Diff

From 4c6fe2e2ea62469642ed1d80b16d39e616b25cf5 Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sat, 2 Sep 2023 19:30:03 +0200
Subject: [PATCH 21/52] patch 9.0.1846: [security] crash in fullcommand
Problem: crash in fullcommand
Solution: Check for typeval correctly
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
src/ex_docmd.c | 2 +-
src/testdir/test_functions.vim | 5 +++++
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 32d52ab21..10d979d49 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -4047,7 +4047,7 @@ f_fullcommand(typval_T *argvars, typval_T *rettv)
|| check_for_opt_bool_arg(argvars, 1) == FAIL))
return;
- name = argvars[0].vval.v_string;
+ name = tv_get_string(&argvars[0]);
if (name == NULL)
return;
diff --git a/src/testdir/test_functions.vim b/src/testdir/test_functions.vim
index 0eda5de38..ab1dbf3b5 100644
--- a/src/testdir/test_functions.vim
+++ b/src/testdir/test_functions.vim
@@ -2962,4 +2962,9 @@ func Test_virtcol()
bwipe!
endfunc
+func Test_fullcommand()
+ " this used to crash vim
+ call assert_equal('', fullcommand(10))
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
--
2.33.0