vim/backport-CVE-2022-0572.patch
huangduirong f1c1e32899 Fix CVE-2022-0572
(cherry picked from commit 73ab23dccaaa4b217c84c483671dc20ee0200bb7)
2022-02-28 17:12:16 +08:00

67 lines
1.7 KiB
Diff

From 6e28703a8e41f775f64e442c5d11ce1ff599aa3f Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 12 Feb 2022 15:42:18 +0000
Subject: [PATCH] patch 8.2.4359: crash when repeatedly using :retab
Problem: crash when repeatedly using :retab.
Solution: Bail out when the line is getting too long.
---
src/indent.c | 5 +++++
src/testdir/test_retab.vim | 20 ++++++++++++++++++++
2 files changed, 25 insertions(+)
diff --git a/src/indent.c b/src/indent.c
index e8e93b9..075802c 100644
--- a/src/indent.c
+++ b/src/indent.c
@@ -1689,6 +1689,11 @@ ex_retab(exarg_T *eap)
if (ptr[col] == NUL)
break;
vcol += chartabsize(ptr + col, (colnr_T)vcol);
+ if (vcol >= MAXCOL)
+ {
+ emsg(_(e_resulting_text_too_long));
+ break;
+ }
if (has_mbyte)
col += (*mb_ptr2len)(ptr + col);
else
diff --git a/src/testdir/test_retab.vim b/src/testdir/test_retab.vim
index e7b8946..5376f92 100644
--- a/src/testdir/test_retab.vim
+++ b/src/testdir/test_retab.vim
@@ -69,6 +69,8 @@ func Test_retab()
call assert_equal(" a b c ", Retab('!', 3))
call assert_equal(" a b c ", Retab('', 5))
call assert_equal(" a b c ", Retab('!', 5))
+
+ set tabstop& expandtab&
endfunc
func Test_retab_error()
@@ -78,3 +80,21 @@ func Test_retab_error()
call assert_fails('ret 10000', 'E475:')
call assert_fails('ret 80000000000000000000', 'E475:')
endfunc
+
+func Test_retab_endless()
+ new
+ call setline(1, "\t0\t")
+ let caught = 'no'
+ try
+ while 1
+ set ts=4000
+ retab 4
+ endwhile
+ catch /E1240/
+ let caught = 'yes'
+ endtry
+ bwipe!
+ set tabstop&
+endfunc
+
+" vim: shiftwidth=2 sts=2 expandtab
--
2.27.0