vim/backport-CVE-2022-2183.patch
rwx403335 88264a8e74 Fix CVE-2022-1720,CVE-2022-2183
(cherry picked from commit 150891f3b3193206262db2aea3a63f7690976916)
2022-07-06 14:25:34 +08:00

60 lines
1.5 KiB
Diff

From 8eba2bd291b347e3008aa9e565652d51ad638cfa Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Wed, 22 Jun 2022 19:59:28 +0100
Subject: [PATCH] patch 8.2.5151: reading beyond the end of the line with lisp
indenting
Problem: Reading beyond the end of the line with lisp indenting.
Solution: Avoid going over the NUL at the end of the line.
---
src/indent.c | 7 +++++--
src/testdir/test_lispwords.vim | 12 +++++++++++-
2 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/src/indent.c b/src/indent.c
index 2d07e2e..a58d6ea 100644
--- a/src/indent.c
+++ b/src/indent.c
@@ -1967,8 +1967,11 @@ get_lisp_indent(void)
amount += 2;
else
{
- that++;
- amount++;
+ if (*that != NUL)
+ {
+ that++;
+ amount++;
+ }
firsttry = amount;
while (VIM_ISWHITE(*that))
diff --git a/src/testdir/test_lispwords.vim b/src/testdir/test_lispwords.vim
index ff710b2..4144fb0 100644
--- a/src/testdir/test_lispwords.vim
+++ b/src/testdir/test_lispwords.vim
@@ -1,4 +1,5 @@
-" Tests for 'lispwords' settings being global-local
+" Tests for 'lispwords' settings being global-local.
+" And other lisp indent stuff.
set nocompatible viminfo+=nviminfo
@@ -85,4 +86,13 @@ func Test_lisp_indent()
set nolisp
endfunc
+func Test_lisp_indent_works()
+ " This was reading beyond the end of the line
+ new
+ exe "norm a\tü(\<CR>="
+ set lisp
+ norm ==
+ bwipe!
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
--
2.27.0