vim/backport-CVE-2022-1886.patch
rwx403335 2f9ff2415c Fix CVE-2022-1886
(cherry picked from commit c2cc83155a9ce0e76319aeff18c375397d72d162)
2022-06-24 15:58:30 +08:00

53 lines
1.4 KiB
Diff
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

From 2a585c85013be22f59f184d49612074fd9b115d7 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Wed, 25 May 2022 15:15:38 +0100
Subject: [PATCH] patch 8.2.5016: access before start of text with a put
command
Problem: Access before start of text with a put command.
Solution: Check the length is more than zero.
---
src/register.c | 7 +++++--
src/testdir/test_put.vim | 9 +++++++++
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/src/register.c b/src/register.c
index 7f77ada..87689f7 100644
--- a/src/register.c
+++ b/src/register.c
@@ -2078,9 +2078,12 @@ error:
len = STRLEN(y_array[y_size - 1]);
col = (colnr_T)len - lendiff;
if (col > 1)
- curbuf->b_op_end.col = col - 1
- - mb_head_off(y_array[y_size - 1],
+ {
+ curbuf->b_op_end.col = col - 1;
+ if (len > 0)
+ curbuf->b_op_end.col -= mb_head_off(y_array[y_size - 1],
y_array[y_size - 1] + len - 1);
+ }
else
curbuf->b_op_end.col = 0;
diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
index 07f6387..6df04cf 100644
--- a/src/testdir/test_put.vim
+++ b/src/testdir/test_put.vim
@@ -143,3 +143,12 @@ func Test_multibyte_op_end_mark()
bwipe!
endfunc
+" this was putting a mark before the start of a line
+func Test_put_empty_register()
+ new
+ norm yy
+ norm [Pi00ggv)s0
+ sil! norm [P
+ bwipe!
+endfunc
+
--
1.8.3.1