vim/backport-illegal-memory-access.patch
rwx403335 2f9ff2415c Fix CVE-2022-1886
(cherry picked from commit c2cc83155a9ce0e76319aeff18c375397d72d162)
2022-06-24 15:58:30 +08:00

42 lines
1.2 KiB
Diff

From 85be8563fe5aff686e9e30d6afff401ccd976f2a Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Thu, 25 Nov 2021 20:40:11 +0000
Subject: [PATCH] patch 8.2.3678: illegal memory access
Problem: Illegal memory access.
Solution: Ignore changed indent when computing byte offset.
---
src/register.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/register.c b/src/register.c
index 49f4079..7f77ada 100644
--- a/src/register.c
+++ b/src/register.c
@@ -1969,6 +1969,7 @@ do_put(
}
else
{
+ size_t len;
// Insert at least one line. When y_type is MCHAR, break the first
// line in two.
for (cnt = 1; cnt <= count; ++cnt)
@@ -2074,11 +2075,12 @@ error:
// Put the '] mark on the first byte of the last inserted character.
// Correct the length for change in indent.
curbuf->b_op_end.lnum = lnum;
- col = (colnr_T)STRLEN(y_array[y_size - 1]) - lendiff;
+ len = STRLEN(y_array[y_size - 1]);
+ col = (colnr_T)len - lendiff;
if (col > 1)
curbuf->b_op_end.col = col - 1
- mb_head_off(y_array[y_size - 1],
- y_array[y_size - 1] + col - 1);
+ y_array[y_size - 1] + len - 1);
else
curbuf->b_op_end.col = 0;
--
1.8.3.1