vim/backport-patch-8.2.5161-might-still-access-invalid-memory.patch
shixuantong b30deda29f fix CVE-2022-2125,CVE-2022-2206
(cherry picked from commit c5521ca91dc920b634ca8e780a02627fd5f31520)
2022-07-05 14:46:17 +08:00

31 lines
967 B
Diff

From 0fbc9260a75dfc4d86f20e7c0eb76878f513a212 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 26 Jun 2022 11:17:10 +0100
Subject: [PATCH] patch 8.2.5161: might still access invalid memory
Problem: Might still access invalid memory.
Solution: Add extra check for negative value.
---
src/message.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/message.c b/src/message.c
index 0b690bb..eae6e61 100644
--- a/src/message.c
+++ b/src/message.c
@@ -876,8 +876,10 @@ msg_may_trunc(int force, char_u *s)
int n;
int room;
+ // If something unexpected happened "room" may be negative, check for that
+ // just in case.
room = (int)(Rows - cmdline_row - 1) * Columns + sc_col - 1;
- if ((force || (shortmess(SHM_TRUNC) && !exmode_active))
+ if (room > 0 && (force || (shortmess(SHM_TRUNC) && !exmode_active))
&& (n = (int)STRLEN(s) - room) > 0)
{
if (has_mbyte)
--
1.8.3.1