vim/backport-CVE-2022-3134.patch
wangjiang 16a43be1fc fix CVE-2022-3134
(cherry picked from commit 8509339e76bd56b70daef434fc674911c13c5bf7)
2022-09-14 17:18:57 +08:00

71 lines
2.2 KiB
Diff

From ccfde4d028e891a41e3548323c3d47b06fb0b83e Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Mon, 5 Sep 2022 19:51:13 +0100
Subject: [PATCH] patch 9.0.0389: crash when 'tagfunc' closes the window
Problem: Crash when 'tagfunc' closes the window.
Solution: Bail out when the window was closed.
---
src/globals.h | 3 +++
src/tag.c | 10 ++++++++++
src/testdir/test_tagfunc.vim | 12 ++++++++++++
3 files changed, 25 insertions(+)
diff --git a/src/globals.h b/src/globals.h
index 3067cfa..1ea3c14 100644
--- a/src/globals.h
+++ b/src/globals.h
@@ -1764,3 +1764,6 @@ EXTERN char e_command_too_recursive[]
EXTERN char e_regexp_number_after_dot_pos_search[]
INIT(= N_("E1204: No Number allowed after .: '\\%%%c'"));
+
+EXTERN char e_window_unexpectedly_close_while_searching_for_tags[]
+ INIT(= N_("E1299: Window unexpectedly closed while searching for tags"));
diff --git a/src/tag.c b/src/tag.c
index aceb6e4..e49a4d4 100644
--- a/src/tag.c
+++ b/src/tag.c
@@ -570,6 +570,16 @@ do_tag(
max_num_matches = MAXCOL; // If less than max_num_matches
// found: all matches found.
+ // A tag function may do anything, which may cause various
+ // information to become invalid. At least check for the tagstack
+ // to still be the same.
+ if (tagstack != curwin->w_tagstack)
+ {
+ emsg(_(e_window_unexpectedly_close_while_searching_for_tags));
+ FreeWild(new_num_matches, new_matches);
+ break;
+ }
+
// If there already were some matches for the same name, move them
// to the start. Avoids that the order changes when using
// ":tnext" and jumping to another file.
diff --git a/src/testdir/test_tagfunc.vim b/src/testdir/test_tagfunc.vim
index 68f2a50..cd60afe 100644
--- a/src/testdir/test_tagfunc.vim
+++ b/src/testdir/test_tagfunc.vim
@@ -93,4 +93,16 @@ func Test_tagfunc_wipes_buffer()
set tagfunc=
endfunc
+func Test_tagfunc_closes_window()
+ split any
+ func MytagfuncClose(pat, flags, info)
+ close
+ return [{'name' : 'mytag', 'filename' : 'Xtest', 'cmd' : '1'}]
+ endfunc
+ set tagfunc=MytagfuncClose
+ call assert_fails('tag xyz', 'E1299:')
+
+ set tagfunc=
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
--
2.33.0