vim/backport-CVE-2022-1927.patch
rwx403335 8abb4a0603 fix CVE-2022-1927
(cherry picked from commit 9f42167633155cb61024e772ab72af63fa9e208e)
2022-06-23 10:07:39 +08:00

124 lines
3.4 KiB
Diff

From 4d97a565ae8be0d4debba04ebd2ac3e75a0c8010 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 28 May 2022 14:25:35 +0100
Subject: [PATCH] patch 8.2.5037: cursor position may be invalid after "0;"
range
Problem: Cursor position may be invalid after "0;" range.
Solution: Check the cursor position when it was set by ";" in the range.
---
src/ex_docmd.c | 24 +++++++++++++++++-------
src/testdir/test_excmd.vim | 9 +++++++++
2 files changed, 26 insertions(+), 7 deletions(-)
diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index a5ff463..b552440 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -2876,6 +2876,8 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
{
int address_count = 1;
linenr_T lnum;
+ int need_check_cursor = FALSE;
+ int ret = FAIL;
// Repeat for all ',' or ';' separated addresses.
for (;;)
@@ -2925,7 +2927,7 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
lnum = get_address(eap, &eap->cmd, eap->addr_type, eap->skip, silent,
eap->addr_count == 0, address_count++);
if (eap->cmd == NULL) // error detected
- return FAIL;
+ goto theend;
if (lnum == MAXLNUM)
{
if (*eap->cmd == '%') // '%' - all lines
@@ -2970,14 +2972,14 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
// there is no Vim command which uses '%' and
// ADDR_WINDOWS or ADDR_TABS
*errormsg = _(e_invrange);
- return FAIL;
+ goto theend;
}
break;
case ADDR_TABS_RELATIVE:
case ADDR_UNSIGNED:
case ADDR_QUICKFIX:
*errormsg = _(e_invrange);
- return FAIL;
+ goto theend;
case ADDR_ARGUMENTS:
if (ARGCOUNT == 0)
eap->line1 = eap->line2 = 0;
@@ -3009,7 +3011,7 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
if (eap->addr_type != ADDR_LINES)
{
*errormsg = _(e_invrange);
- return FAIL;
+ goto theend;
}
++eap->cmd;
@@ -3017,11 +3019,11 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
{
fp = getmark('<', FALSE);
if (check_mark(fp) == FAIL)
- return FAIL;
+ goto theend;
eap->line1 = fp->lnum;
fp = getmark('>', FALSE);
if (check_mark(fp) == FAIL)
- return FAIL;
+ goto theend;
eap->line2 = fp->lnum;
++eap->addr_count;
}
@@ -3036,10 +3038,13 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
if (!eap->skip)
{
curwin->w_cursor.lnum = eap->line2;
+
// Don't leave the cursor on an illegal line or column, but do
// accept zero as address, so 0;/PATTERN/ works correctly.
+ // Check the cursor position before returning.
if (eap->line2 > 0)
check_cursor();
+ need_check_cursor = TRUE;
}
}
else if (*eap->cmd != ',')
@@ -3055,7 +3060,12 @@ parse_cmd_address(exarg_T *eap, char **errormsg, int silent)
if (lnum == MAXLNUM)
eap->addr_count = 0;
}
- return OK;
+ ret = OK;
+
+theend:
+ if (need_check_cursor)
+ check_cursor();
+ return ret;
}
/*
diff --git a/src/testdir/test_excmd.vim b/src/testdir/test_excmd.vim
index 992fc3d..aafee84 100644
--- a/src/testdir/test_excmd.vim
+++ b/src/testdir/test_excmd.vim
@@ -44,3 +44,12 @@ func Test_buffers_lastused()
bwipeout bufb
bwipeout bufc
endfunc
+
+" This was leaving the cursor in line zero
+func Test_using_zero_in_range()
+ new
+ norm o00
+ silent! 0;s/\%')
+ bwipe!
+endfunc
+
--
1.8.3.1