vim/backport-CVE-2022-0729.patch
2022-03-05 14:10:14 +08:00

48 lines
1.3 KiB
Diff

From 6456fae9ba8e72c74b2c0c499eaf09974604ff30 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 22 Feb 2022 13:37:31 +0000
Subject: [PATCH] patch 8.2.4440: crash with specific regexp pattern and string
Problem: Crash with specific regexp pattern and string.
Solution: Stop at the start of the string.
---
src/regexp_bt.c | 5 +++++
src/testdir/test_regexp_utf8.vim | 7 +++++++
2 files changed, 12 insertions(+)
diff --git a/src/regexp_bt.c b/src/regexp_bt.c
index b71b862..e017ba5 100644
--- a/src/regexp_bt.c
+++ b/src/regexp_bt.c
@@ -4431,6 +4431,11 @@ regmatch(
if (rex.input == rex.line)
{
// backup to last char of previous line
+ if (rex.lnum == 0)
+ {
+ status = RA_NOMATCH;
+ break;
+ }
--rex.lnum;
rex.line = reg_getline(rex.lnum);
// Just in case regrepeat() didn't count
diff --git a/src/testdir/test_regexp_utf8.vim b/src/testdir/test_regexp_utf8.vim
index 6d0ce59..5d1bd47 100644
--- a/src/testdir/test_regexp_utf8.vim
+++ b/src/testdir/test_regexp_utf8.vim
@@ -223,3 +223,10 @@ func Test_match_invalid_byte()
call delete('Xinvalid')
endfunc
+func Test_match_too_complicated()
+ set regexpengine=1
+ exe "vsplit \xeb\xdb\x99"
+ silent! buf \&\zs*\zs*0
+ bwipe!
+ set regexpengine=0
+endfunc
--
2.27.0