vim/backport-CVE-2023-0049.patch
2023-01-09 15:31:30 +08:00

45 lines
1.3 KiB
Diff

From 7b17eb4b063a234376c1ec909ee293e42cff290c Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Wed, 4 Jan 2023 14:31:49 +0000
Subject: [PATCH] patch 9.0.1143: invalid memory access with bad 'statusline'
value
Problem: Invalid memory access with bad 'statusline' value.
Solution: Avoid going over the NUL at the end.
---
src/buffer.c | 2 ++
src/testdir/test_statusline.vim | 7 +++++++
2 files changed, 9 insertions(+)
diff --git a/src/buffer.c b/src/buffer.c
index 98568987894e..40168226160c 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -4576,6 +4576,8 @@ build_stl_str_hl(
#endif
if (vim_strchr(STL_ALL, *s) == NULL)
{
+ if (*s == NUL) // can happen with "%0"
+ break;
s++;
continue;
}
diff --git a/src/testdir/test_statusline.vim b/src/testdir/test_statusline.vim
index a829597655bf..23613bfed37b 100644
--- a/src/testdir/test_statusline.vim
+++ b/src/testdir/test_statusline.vim
@@ -436,6 +436,13 @@ func Test_statusline()
set splitbelow&
endfunc
+func Test_statusline_trailing_percent_zero()
+ " this was causing illegal memory access
+ set laststatus=2 stl=%!%0
+ call assert_fails('redraw', 'E15: Invalid expression: "%0"')
+ set laststatus& stl&
+endfunc
+
func Test_statusline_visual()
func CallWordcount()
call wordcount()