vim/backport-CVE-2023-2609.patch
2023-05-13 14:41:02 +08:00

55 lines
1.8 KiB
Diff
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

From d1ae8366aff286d41e7f5bc513cc0a1af5130aad Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 9 May 2023 17:09:30 +0100
Subject: [PATCH] patch 9.0.1531: crash when register contents ends up being
invalid
Problem: Crash when register contents ends up being invalid.
Solution: Check "y_array" is not NULL.
---
src/register.c | 2 +-
src/testdir/test_registers.vim | 17 +++++++++++++++++
2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/src/register.c b/src/register.c
index f3df79cfd642..e481d843c249 100644
--- a/src/register.c
+++ b/src/register.c
@@ -300,7 +300,7 @@ get_register(
if (copy)
{
// If we run out of memory some or all of the lines are empty.
- if (reg->y_size == 0)
+ if (reg->y_size == 0 || y_current->y_array == NULL)
reg->y_array = NULL;
else
reg->y_array = ALLOC_MULT(char_u *, reg->y_size);
diff --git a/src/testdir/test_registers.vim b/src/testdir/test_registers.vim
index e966932478d8..33ea0f4bd3e6 100644
--- a/src/testdir/test_registers.vim
+++ b/src/testdir/test_registers.vim
@@ -798,6 +798,23 @@ func Test_end_reg_executing()
bwipe!
endfunc
+" This was causing a crash because y_append was ending up being NULL
+func Test_zero_y_append()
+ " Run in a separate Vim instance because changing 'encoding' may cause
+ " trouble for later tests.
+ let lines =<< trim END
+ d
+ silent ?n
+ next <sfile>
+ so
+ sil! norm 0V€PSP
+ set enc=latin1
+  
+ END
+ call writefile(lines, 'XTest_zero_y_append', 'D')
+ call RunVim([], [], '-u NONE -i NONE -e -s -S XTest_zero_y_append -c qa\!')
+endfunc
+
" Make sure that y_append is correctly reset
" and the previous register is working as expected
func Test_register_y_append_reset()